All,
I need to compare the results of two different searches and I am lost.
Something like this.
count( search status=success) < count (search status=error) then alarm.
How do I get the value of two searches and run a compare?
BTW, nicely explained. Unless I completely misunderstood it, of course!
Try this:
sourcetype=xyz or whatever
| stats count(eval(status="success")) as successCount count(eval(status="error")) as ErrorCount
and use a custom condition for your alarm: errorCount >= successCount
However, the above will only work if the basic search on the first line is the same for both successes and errors. Also, the eval
function is case-sensitive, so make sure that the values success/error are actually lower-case.
What if your successes are recorded in one log file but errors come from a different source? Here's a solution when the two base searches are different. It isn't as efficient, though:
sourcetype=abc status=success
| stats count as successCount
| appendcols [ search sourcetype=xyz status=error
| addinfo | where _time >= info_min_time AND _time <= info_max_time
| status count as errorCount ]
And you would use exactly the same custom condition: errorCount >= successCount
What is all that addinfo
and other stuff? Well, the second solution uses a subsearch. The subsearch will run over all time unless you provide a time range. The addinfo
and where
commands retrieve the time range of the first search and apply it to the subsearch.
Hope this helps!