How to calculate the number of events which crossed the threshold limit.

[theouhuios]

hello

I am trying to create a 24hour chart with the number of times the threshold has been exceeded in the number of events being created for that Component.

The data will be as

Now if we consider as the count of events created for WASBDYN4 as I and if its count is more than the threshold for that Component I need to generate an email alert and also create a timechart on the basis of how many times has the threshold been exceeded for that particular component. I am using the below stats command to count the number of events, but its not working. Any ideas/suggestions on how to do it.

stats count(eval(notify=if(I>threshold,1))) as Notify

Regards

theou

[lguinn2]

I don't understand the problem very well, but try this

stats count(eval(I>threshold)) as Notify

In the count function, the eval must evaluate to either True or False. Events where eval is True will be counted.