Forum Discussion
PDisme110
May 15, 2023Copper Contributor
status code threshold
Trying to figure out how to find events where status code 200 goes above a certain avg threshold, say 10%. I think I have the avg figured out, but unsure how to get the rest written. Any help would be appreciated.
W3CIISLog
| where TimeGenerated > ago(7d)
|where scStatus =="200"
| summarize totalCount = count() by bin(TimeGenerated, 1h), scStatus
|summarize avghits =(avg(totalCount))
No RepliesBe the first to reply