How would I go about having an alert set at a given threshold ?
When I run the following, I sometimes get incomplete results in the stats table due to not every field meeting the number 6
index=_internal AND NOT email="blank@domain.com"
| stats count by email, Message, client.ipAddress, geographical.city
| where count>6
| sort -count
When I try the following, I get an alert for 6 total events with no threshold criteria met.
Trigger Condition:
Number of Results is > 6.
Desired outcome would be a criteria of the set threshold met and only when it is met. For example, an alert to fire on the 'count' of a given event occurring 6 times
Appreciate any tips in advance
In your query, you are already filtering events having count>6. So you trigger condition should be
Trigger Condition:
Number of Results is > 0
Trigger condition purely works on the results of the query and does not modify the query itself.
Thank you , modified my Trigger Condition accordingly
In your query, you are already filtering events having count>6. So you trigger condition should be
Trigger Condition:
Number of Results is > 0
Trigger condition purely works on the results of the query and does not modify the query itself.