Hello,
I have this following search:
source="Laura_ACS" earliest=-15m latest=now| eventstats count as "totalVE"| eventstats count(eval(STAT_VE="N")) as "totalVENO"|eval percent=(totalVENO/totalVE)*100 | stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX|search TAUX=100
I want to calculate this search every 5min for the last 15min. How can I do it?
Thx by advance,
Laura
I resolve my problem: this my actually search:
source="Laura_ACS" earliest=-15m latest=now| bucket _time span=5m | eventstats count as "totalVE" by _time| eventstats count(eval(SD_STAT_PA="N")) as "totalVENO" by _time|eval percent=(totalVENO/totalVE)*100 |stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX by _time |search TAUX=100
I resolve my problem: this my actually search:
source="Laura_ACS" earliest=-15m latest=now| bucket _time span=5m | eventstats count as "totalVE" by _time| eventstats count(eval(SD_STAT_PA="N")) as "totalVENO" by _time|eval percent=(totalVENO/totalVE)*100 |stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX by _time |search TAUX=100