Hello,
I set up an alert to search for an error message that appears in one my windows application. Time-wise I set it up to search the last 10 minutes only.
SourceName="My Web Client" Message="My Error Message" earliest=-11m@m latest=-1m@m
| timechart span=5m count values() BY source
Which produces this result (see image) :
This almost works for what I want. But, I want this to trigger an email to me only if the second row's count is = 0. Right now it alerts regardless of any number, including 0.
How do I declare that row2's count must be 0? row1 is allowed to be any count number it wants, but row2 must be 0, otherwise I do not want the alert to trigger.
Thanks,
Jeff
Try this
SourceName="My Web Client" Message="My Error Message" earliest=-11m@m latest=-1m@m
| timechart span=5m count values() BY source
| eventstats list(count*) as list* | eval shouldAlert="No"
| foreach list* [| eval shouldAlert=if(mvindex('<<FIELD>>',1)==0,"Yes",shouldAlert) ]
| where shouldAlert="Yes"
Hello,
Line 3 was hepful, but line 4 causes this error:
Error in 'eval' command: Typechecking failed. The '==' operator received different types