I am trying to create a low volume type of alert based on one sourcetype for multiple Channels that have very different amounts of traffic. The search I am using is as follows:
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold?=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold?=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| table Channel Count MeetThreshold?
In my tests, it seems the results only reflect the status of the last eval statement. Is there a better way to do this?
You need to use case
like this:
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
(Count<=4) AND (Channel=="Web"), "Fail",
(Count<=400) AND (Channel=="Mobile"), "Fail",
true(), "Pass")
| table Channel Count MeetThreshold
You need to use case
like this:
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
(Count<=4) AND (Channel=="Web"), "Fail",
(Count<=400) AND (Channel=="Mobile"), "Fail",
true(), "Pass")
| table Channel Count MeetThreshold
That is perfect. Thank you
Thats because your defining the same field name. try this approach instead:
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold1=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold2=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| eval MeetThreshold=coalesc(MeetThreshold1,MeetThreshold2)
| table Channel Count MeetThreshold
Or you can make one long case / if:
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=if((Count<=4 AND Channel=="Web"),"Fail",if((Count<=400 AND Channel=="Mobile"),"Fail","Pass")))
| table Channel Count MeetThreshold
sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
Count<=4 AND Channel=="Web","Fail",
Count<=400 AND Channel=="Mobile","Fail",
1=1,"Pass")
| table Channel Count MeetThreshold