Hi, Can anyone help, As I want to get an alert if : The volume gets drop or if processing time gets increased of a specific server when being compared with last 5 minutes - The query should use volume and average response of current 5 minutes and last 5 minutes. and then if there is difference in volume < 50% or processing time > 60% then alert.
Hi @sahil237888,
Please try below sample;
index=your_index earliest=-15m
| timechart span=5m partial=f avg(response_time) as response_time sum(volume) as volume
| autoregress response_time p=1
| autoregress volume p=1
| where response_time>response_time_p1*1.6 OR volume<volume_p1*0.5