hello
I am trying to create a 24hour chart with the number of times the threshold has been exceeded in the number of events being created for that Component.
The data will be as
Now if we consider as the count of events created for WASBDYN4 as I and if its count is more than the threshold for that Component I need to generate an email alert and also create a timechart on the basis of how many times has the threshold been exceeded for that particular component. I am using the below stats command to count the number of events, but its not working. Any ideas/suggestions on how to do it.
stats count(eval(notify=if(I>threshold,1))) as Notify
Regards
theou
I don't understand the problem very well, but try this
stats count(eval(I>threshold)) as Notify
In the count function, the eval must evaluate to either True or False. Events where eval is True will be counted.