How to create a search to set an Alert only when two conditions met?

[chinmay25]

I have the following query that gives the count for port and CPU percent. 

index=abc source=xyz SMFID=EDCD SMF119HDSubType=2
| timechart span=60m count by SMF119AP_TTLPort_0001 usenull=f useother=f | stats values(*) as * by _time
| untable _time Port Count
| where Count > 4000 | eval DATE = strftime(_time,"%m/%d/%y %H:%M:%S.%2N")
| eval Date = substr(DATE,1,9) | eval Hours = substr(DATE, 11,18)
| appendcols [search index=abc source=xyz (SYSNAME=EDCD) ((date_wday=tuesday AND date_hour=*) OR (date_wday=wednesday AND date_hour=*) OR (date_wday=thursday AND date_hour=*) OR (date_wday=friday AND date_hour=*) OR (date_wday=monday AND date_hour=10) OR (date_wday=monday AND date_hour=11) OR (date_wday=monday AND date_hour=12) OR (date_wday=monday AND date_hour=13) OR (date_wday=monday AND date_hour=14) OR (date_wday=monday AND date_hour=15) OR (date_wday=monday AND date_hour=16) OR (date_wday=monday AND date_hour=17) OR (date_wday=monday AND date_hour=18) OR (date_wday=monday AND date_hour=19) OR (date_wday=monday AND date_hour=20) OR (date_wday=monday AND date_hour=21) OR (date_wday=monday AND date_hour=22) OR (date_wday=monday AND date_hour=23) OR (date_wday=saturday AND date_hour=0) OR (date_wday=saturday AND date_hour=1) OR (date_wday=saturday AND date_hour=2) OR (date_wday=saturday AND date_hour=3) OR (date_wday=saturday AND date_hour=4) OR (date_wday=saturday AND date_hour=5) OR (date_wday=saturday AND date_hour=6) OR (date_wday=saturday AND date_hour=7))
| bin span=1h@h _time | eval "Hours"=strftime('_time',"%H:%M:%S.%2N") | eval DATE = strftime('_time',"%m/%d/%y %H:%M:%S.%2N") | eval Date = substr(DATE, 1,9)
| eval CPU = round(RCVCPUA/16,2)
| stats avg(CPU) as "CPU" by Hours Date | eval CPU=round(CPU,2)
]
| table Date Hours Port Count CPU

This generates the following result. I want to set an alert only when the count is >5000 and CPU >80. What combined statement can be used to get the desired result?

Date	Hours	Port	Count	CPU
08/22/23	7:00:00.00	23050	75787	38.42
08/22/23	8:00:00.00	23050	19854	84.56
08/22/23	9:00:00.00	23008	4126	37.16
08/22/23	9:00:00.00	23050	20121	35.71

[ITWhisperer · Accepted solution]

| where Count>5000 AND CPU>80

[chinmay25]

For some reason where command was not working earlier.

I realized that I had missed one statement in the query at the beginning.

Thank you.