Hi there,
I need to create an alert basing on average failure rate in 60 min. Here is my search sourcetype="mysourceType" AppID = "myApp" | eval Failed= if( myData> 0, 1, 0) | stats avg(Failed) as FailRate
The alert condition is search FailRate > 0.1
However the search returns the intermediate results before the search is complete. I want the alert generated only the search is complete in 60 min. I couldn't figure out to create a search only shows the final overall average for FailRate for the alert.
Any help is appreciated.
Thanks
maybe you could try adding a where clause at the end and then firing the alert if it finds an event
| where FailRate > 0,1
Thanks, I have tried everything I know and it doesn't work because the alert gets triggered multiple times before of the immediate results from the search.