Hi ALL,
need help for a using case here.
we are trying to setup alert based on below data
value1 ( the average of past 7days since yesterday)
value2 ( the average of yesterday's day)
if value2 is lower than 70% of value1 , trigger alerts.
below is what I use to setup this query
index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-7d@d latest=-2d@d | stats avg(value) as 7day by desc | appendcols [ search index=main topoName=EnrichmentTopology datacenter=NA desc=ENR131 earliest=-2d@d latest=-1d@d | stats avg(value) as 1day by desc] | eval diff=(7day-1day)
but it always return me
Error in 'eval' command: The expression is malformed. Expected ).
any idea ? thx a lot
↧