在不使用“基于评估”的情况下发送警报在条件中（配置信号逻辑） [英] Sending Alert without using "Evaluated based on" in the Condition (Configure signal logic)

问题描述

我在其中查询了一个日期时间过滤器（动态期间过滤器）。是不是你不知道
不必须填写 "评估基于"在警报条件中，您可以禁用该选项吗？

Hi, I made a query with a datetime filter in it (a dynamic period filter). Is it not an idea that you do not have to fill in the "Evaluated based on" in the Condition of the Alert, that you can disable that option?

因为我的时间段是动态的，所以 "基于"评估"不方便!!我只想在特定动态时间段内结果数量较高而不是基于"基于评估的
on"中提到的时段时发出警报。

Because my period of time is dynamic, the "Evaluated based on" is not handy!! I only want an alert when the number of results are higher in that specific dynamic period of time and not based on the period mentioned in "Evaluated based on".

推荐答案

IMHO在创建警报时，在配置信号逻辑部分下，根据设计，我们有"基于"评估"部分，基本上是

IMHO while creating alert, under configure signal logic part, as per design we have this "Evaluated based on" section, which basically is about

1。期间，即检查度量值的回顾窗口

1. Period i.e., the look back window over which metric values are checked

2。频率，即公制警报检查条件是否满足的频率



AFAIK是强制性的，因为（期间和频率）是自动根据的标准连续运行提供的查询（直到警报被禁用）并在达到阈值时决定是否发出警报。但查询中使用的时间相关运算符
可帮助您根据查询中提供的时间条件获取输出，该时间条件无法自动且连续地运行警报。



如果是"动态时间段"，在你的话中，意思是说最后x秒，分钟，小时，天等等。如果你的查询看起来像下面显示的那样"query1" （在此示例中考虑动态时间段为最后5分钟）如果您希望自动收到
，则需要"基于"评估"创建警报时的部分，因为理想情况下，如果在创建警报
之后的最后5分钟内达到阈值条件，则会连续监视，直到您将其禁用为止。



query1 ：
$

2. Frequency i.e., the frequency with which the metric alert checks if the conditions are met

AFAIK it's mandatory because this (Period and Frequency) is the criteria based on which it automatically runs the provided query continuously (until the alert is disabled) and decides whether to alert or not when threshold is met. But the time related operators used inside the query helps you to get the output based on the time conditions you provide in the query which doesn't do anything to make alert run automatically and continuously.

If "dynamic period of time" in your words is meant as say last x seconds, minutes, hours, days, etc. and if your query looks something like shown below "query1" (considering dynamic period of time as last 5 minutes in this example) and if you want to get alerted automatically then you would need "Evaluated based on" section while creating alert because you ideally want to monitor continuously if the threshold condition is met in say last 5 minutes of time since creating the alert until you disable it.

query1:

aaaa | where bbbb == "bbbb"| where TimeGenerated > ago(5m)| summarize AggregatedValue= count(cccc) by Computer, bin(TimeGenerated, 30s)

如果"动态"一段时间"在你的话中，意思是说每天从x秒到y秒（或）从x分钟到y分钟（或）从x小时到y小时（或）x天到y天等，如果你的查询看起来像如下所示"query2"
（考虑从2019-03-26的22小时到2019-03-27的22小时的动态时间段），如果您想自动收到警报，那么您仍然需要"基于评估" ;创建警报时的部分（可能在2019-03-26
22:00:00之前），因为理想情况下，如果在创建警报后的最后24小时内达到阈值条件，您将持续监控，直到您禁用它（也就是说，在这个例子中，您可以在2019-03-27
22:00:00之后的某个时间禁用警报）。 



query2 ：
$

If "dynamic period of time" in your words is meant as say daily from x seconds to y seconds (or) from x minutes to y minutes (or) from x hours to y hours (or) x days to y days, etc. and if your query looks something like shown below "query2" (considering dynamic period of time from 22 hours of 2019-03-26 to 22 hours of 2019-03-27 in this example) and if you want to get alerted automatically then you would still need "Evaluated based on" section while creating alert (probably before 2019-03-26 22:00:00), because you ideally want to monitor continuously if the threshold condition is met in say last 24 hours of time since creating the alert until you disable it (i.e., in this example probably you can disable the alert at sometime after 2019-03-27 22:00:00). 

query2:

aaaa | where bbbb == "bbbb"| where TimeGenerated between(datetime("2019-03-26 22:00:00") .. datetime("2019-03-27 22:00:00"))| summarize AggregatedValue= count(cccc) by Computer, bin(TimeGenerated, 30s)

希望这会有所帮助！ ！干杯！！ ：）

Hope this helps!! Cheers!! :)

这篇关于在不使用“基于评估”的情况下发送警报在条件中（配置信号逻辑）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！