I'm trying to convert this Search into an alert
index=cj t=* earliest=-60m | eval myfield=case(t >= .051, "Over", t <= .050, "Under") | timechart count by myfield | eval Total=Over+Under |eval OverPerc=100*Over/Total | eval UnderPerc=100*Under/Total | fields Total Under UnderPerc Over OverPerc
i've tried searchtimespanminutes but the output still shows in like 5 second increments.
I want to add ... |where OverPerc>= .1
But want it to be over say a 10 minute period, I want OverPerc to not exceed .1 over a given timeframe, even in real time, it should not alert if it's only matched one result, it should wait until it loads the 60 minutes or 10 minutes, or 5 minutes of data to make the match.
Thanks
To force your timechart
into grouping larger spans of time together, change it like this:
... | timechart span=10m count by myfield | ...
In case you're getting false positives due to the clock being for example 02:00:05 and only one event occurred during those five seconds, you can add this:
... | timechart span=10m partial=f count by myfield | ...
That way buckets are discarded if the ten minute span isn't over yet.
BAHH, always trying to make it harder then it is.. Thanks this worked!