Is there a way to count the number of sourceHosts rather than counting the number of messages per sourceHost?

Follow

James Witt

• May 14, 2015 22:06

I want to be able to send out an alert based on a certain number of Hosts sending messages, not based on how many messages the Hosts are sending.

0

• 

  Kevin Keech

  • May 14, 2015 22:12

  Hi James,

  In your query try the following.

  | count_distinct(_sourceHost) as host_count
  
  | where host_count > 10

  Within the "where" statement place your threshold for the alert. Then within your scheduled search set the alert threshold to query if the count of results is less than 1

  0

  Comment actions Permalink

Please sign in to leave a comment.