I have the following query:
.... | eval time_sec = round(time_taken/1000) | chart max(time_sec) as max_response_time by cs_uri_stem
The aim of the above is to return the maximum response time of the pages mentioned in the ... section. I want this query to be scheduled to run at midnight. Also, if the max_response_time of any page in the result set is higher than a value (say xx), it should alert by sending mails.
How do I achieve this?
| eval time_sec = round(time_taken/1000)
| chart max(time_sec) as max_response_time by cs_uri_stem
| where
max_response_time
> xx
| sendemail to="elvis@server.com,john@server.com" format=html subject=myresults server=mail.server.com`
Then you saved the search and edit it in Manager >> Searches & Reports, to set the schedule