Compare current and last one hour event value in same search.

[vaibhavvijay9]

Hi All,

I have to monitor the queues. And for that I have made the basic dashboard where it shows the details. Details are like : queueName, inTotalMsgs, outTotalMsgs, pendingMsgCount and dedup the queueName.

Now, what I want is (another search [new]): "If the current pendingMsg count is greater than or equal to the last one hour count, then display the queueName with label - 'Queue with no processing since last one hour' "
(OR we can say the outTotalMsgs is same for now and last one hour event)

Example :
My basic new search no dedup applied, but currently I have written only one queueName :

..... | xmlkv | table _time, qName, pendingMsgCount, inTotalMsgs, outTotalMsgs

Timestamp (last 60 minutes) - (22/02/2019 06:58:00.000 to 22/02/2019 07:58:13.000)

Results : only one queueName (124 events)

• first two :
  

• last two :
  

So, for this queueName, the pendingMsg count is same and hence it should be displayed in results for dashboard - 'Queue with no processing since last one hour'.

I am not able to achieve this, please help!

Thanks in advance!

[renjith_nair]

@vaibhavvijay9 ,

Try

 | xmlkv | table _time, qName, pendingMsgCount, inTotalMsgs, outTotalMsgs|dedup _time,qName
 |sort _time,qName
 |streamstats last(pendingMsgCount) as prev current=f by qName
 |eval diff=pendingMsgCount-prev| where diff>=0

This should give you Q names which haven't processed in last hour