Hi,
I'm trying to set up an alert that checks for three '0' values in a row from the same "lane". If a non-zero value is found in between no alert is made. The transaction coming through from the logs looks like:
NAME=2012_07_20_07_59_56_729_0_00004_00002.jpg,OCR=BJH27V,CONFIDENCE=563,STATE=NSW,LANE=4
Basically, whenever there's three CONFIDENCE=0 in a row in the same LANE, I need an alert to be sent. I tried following some steps from another question posted here which used streamstats, but I'm not sure how to use it and also differentiate by lane.
All help is appreciated! Thanks!
With realtime search, you could use:
... | dedup 3 LANE | stats count(CONFIDENCE==0) as count | where count==3
In a non-realtime periodic search, use:
... | streamstats current=t window=3 global=f
count(CONFIDENCE==0) as count
by LANE
| where count==3
Then you can either just use a per-result alert for each LANE value (which you really should do for the realtime version), or get an alert whenever you get more than 0 results from this search.
I tried the non-realtime periodic search and I've yet find any results from it. I know there exists plenty of times where there's 3 CONFIDENCE=0 in a row. Not sure what else I can try.