How to enable alert if sourceCategoriesor category has no logs over 1 hour duration in the collector
Is it possible to trigger the sumo alert when the category and source category has not received any log in the collectors over the last 1-hour duration?
Sample query attached below. Feel free to customize it.
| _receiptTime as receipt_time
| now() as current_time
| (current_time - receipt_time)/1000/60/60 as diff_hours
| where diff_hours < 1
| formatDate(toLong(receipt_time),"YYYY-MM-dd HH:mm:ss") as receipt_time_string
| count by receipt_time_string, diff_hoursComment actions
Please sign in to leave a comment.