Each Monday the skype call logs have a low count;
e.g skypeuk is around 30 and skypeus is around 200 events whereas the rest of the week skypeuk is 290 and skypeus is 700.
How do I add in an exception for this or a separate search for this for to run a separate search if the day is Monday.
| tstats count as "Data Received" where index=msexchange host=opspkhf03p source=otl_dbin_skypeuk
| eval result=if('Data Received'> 290, "PASS", "FAIL")
| eval host="opspkhf03p"
| append
[| tstats count as "Data Received" where index=msexchange host=opspkhf03p source=skypeus
| eval result=if('Data Received'> 700, "PASS", "FAIL")
| eval host="opspkhf03p"]
| table host, "Data Received", result
You can do the tstats by _time and then evaluate if it is a Monday or not:
| tstats count where index=_internal by _time span=1d
| eval date_wday=strftime(_time,"%A")
| eval result=if(count> 700 AND date_wday=="Monday", "PASS", "FAIL")