Forum Discussion

PDisme110's avatar
PDisme110
Copper Contributor
May 15, 2023

status code threshold

Trying to figure out how to find events where status code 200 goes above a certain avg threshold, say 10%. I think I have the avg figured out, but unsure how to get the rest written. Any help would be appreciated. 

 

W3CIISLog
    | where TimeGenerated > ago(7d)
    |where scStatus =="200"
    | summarize totalCount = count() by bin(TimeGenerated, 1h), scStatus
    |summarize avghits =(avg(totalCount)) 

No RepliesBe the first to reply