Configure an alert based on the number of results as warning, high, critical in same alert

[chandrasekharko]

I want to configure an alert with different thresholds as in

Warning - count > 5
High - count > 10
Critical - Count > 15

If there are 10 results in the count then I need to get an alert saying it is critical not the the warning and high.

[somesoni2]

You want to set Severity based on count OR will a Text in subject line with Severity is ok?

[chandrasekharko]

Based on count

[woodcock · Accepted solution]

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

[chandrasekharko]

What does N/A means here?
The subject looks like this:
Working On it N/A
It should say Working On it Critical as the results are around 20

[woodcock]

You used both count and Count; make sure that the search is correct and that it generates the correct value for criticality based on Count/count and then it should work.

[chandrasekharko]

This is how my query looks like after the search:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p") | table time,host,c_ip,cs_uri_stem,s_ip,s_port,sc_status,sc_substatus,time_taken | eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Am I doing anything wrong here?

[woodcock]

You have not calculated a count field! Maybe something like this:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| stats count BY host c_ip cs_uri_stem s_ip s_port sc_status sc_substatus time_taken
| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

[chandrasekharko]

Sorry for keep bugging you on this. The criticality still showing me as N/A

[woodcock]

What I wrote ABSOLUTELY works. We are going to have to stop playing the "this isn't really my search" game and you'll have to post your real search if you need to get it right. For example, in your fragment you are calculating time but not using it....