Hello
I have a search that timecharts useragent count by useragent. Simply
index=apache useragent=* | timechart count by useragent limit=100
what I would like to do is overlay a lower boundary so if the count in part of this span is lower than the boundary send an alert.
I tried this several different ways.
This was my last attempt:
index=apache* useragent=* | stats count as TotalCount, avg(TotalCount) AS AvgCount, perc5(TotalCount) by _time, useragent
Unfortunately I only get a TotalCount and nothing more.
Any ideas?
Thanks!
Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.
index=apache* useragent=*
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count
Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.
index=apache* useragent=*
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count
Haha was just gettign there myself:
index=apache* useragent=* | timechart count by useragent | eventstats perc5(count) as Lower by useragent
was close at least.
Small changes