I have an alert that is triggering when conditions are not met. The search for the alert is:
index=foo earliest=-1d@d latest=@d setMeterSpot SystemName!=foo1 SystemName!=foo2 | eval SystemName=upper(SystemName)| timechart span=1d count(SessionId) by SystemName usenull=f | sort -_time | rename _time as "Date Logged" | convert timeformat="%Y-%m-%d" ctime("Date Logged")
This search returns a table with 7 columns. Date Logged, and 6 columns with system names. The first column returns the date for the day of the search and the other 6 columns return a number value. Standard number for a daily search on this is 288. I was trying to setup an alert that triggered when the number was below 260 in any of the 6 columns. I tried using the same search and setting a condition to trigger if number of results is less than 260. I thought it was working but I have had the alert trigger when there is not a column that is below 260.
Do I need a where condition in there?
Is the trigger condition adding every column to get the number to trigger off of?
Please advise.
I'd suggest you change your search to only return rows you want to alert on (include the where / search clause in your search string to limit your results). Then simply use the alert condition: when search results > 0.
Hope this helps