ncmfn
(nc)
1
Hello,
Is there any way to compare the avg of a field with the sum of that field instead of a threshold in Graylog alerts?
In other word:
if avg(value) > sum (value) then alert
gsmith
(GSmith)
2
Hello
Are you referring to something like this for a Event Definition?
ncmfn
(nc)
3
Hi @gsmith ,
Instead of these static numbers(0 and 14 in your screenshot), I wanna be able to call another function.
for example:
sum(AccessMask) > avg(AccessMask)
gsmith
(GSmith)
4
Not sure about that, you want the sum greater then the avg. Could you give an example of that?
EDIT: Something of this sort? The red box shows what its function is.
If this is not what you want maybe Event Correlation instead of Filter & Aggregation maybe something to look into.
ncmfn
(nc)
5
Thanks @gsmith,
The point is you are still comparing the sum and avg functions to a static number. in my case there is no specific threshold to set.
