Usecase
Send Notification when there is no login activity (threshold count < 1) from a particular department say "Accounts" for every day. Login activity of Department is identified by a particular range of IP address with field name "srcIp".
Notification Types: Email
User Inputs
Please find the below image for setting up alerts in Skedler-Alerts
Notification received via Email
Hi,
Alert has been triggered for alert No Login Activity on Tue May 01,2018 10:00:00 IST
Alert Condition:
Rule Type: Flat Line, Keyword Filter: * - select * from .data* where srcIp must > 10.200.1.3 and srcIp must < 10.200.1.49 and where timeWindow between Mon Apr 30,2018 10:00:00 IST - Tue May 01,2018 10:00:00 IST having count < 1
TimeWindow:
Mon Apr 30,2018 10:00:00 IST - Tue May 01,2018 10:00:00 IST
Matching Records:
No Payload Result / Aggregation Result found
http://guidanzadmin:3001/skedler-alerts/alertdetails?alertId=No%20Login%20Activity&alertname=No%20Login%20Activity&triggered_time=2018-05-01T04:30:30.000Z
Thanks
Notification received via email attachment
[ { "payload_result1": { "total": 0, "max_score": null, "hits": [] }, "aggregations_result1": { "count": { "value": 0 } } } ]