Alerting

Conditional alerting examples?

the_wolverine
Champion

I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:

mysearch | stats count dc(memberUid)

condition: 0 < dc(memberUid) < 50

1 Solution

ftk
Motivator

Try renaming your distinct count field.

mysearch | stats count dc(memberUid) as dc_uid

condition: 0 < dc_uid < 50

View solution in original post

ftk
Motivator

Try renaming your distinct count field.

mysearch | stats count dc(memberUid) as dc_uid

condition: 0 < dc_uid < 50

View solution in original post

the_wolverine
Champion

That worked. Thanks 🙂

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!