Hi ,
I am using the below query to get an average count . But how do I write a query to send an alert when the number of records goes below 20% of the daily average?
index= abc platform=xyz | stats avg(count) by _time
Assuming you're running the alert daily to compare yesterday's (full day) count to check if it was less than daily average count over last 7 day (or 7 days prior to yesterday), try something like this (timerange selected to include data for past 8 days, excluding today):
index=abc platform=xyz earliest=-8d@d latest=@d | timechart span=1d count
| eval yesterday=if(_time=relative_time(now(),"-1d@d"), count, null())
| eval lastweek=if(_time<relative_time(now(),"-1d@d"), count, null())
| stats values(yesterday) as yesterday avg(lastweek) as dailyavg
| where yesterday<=0.8*dailyavg
@somesoni2
I tried using the above query , but It don't see any results .