Fix Issue #224

guilhemmarchand · Jan 28, 2021 · 88ab54b · 88ab54b
1 parent 01ec412
commit 88ab54b
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/docs/releasenotes.rst b/docs/releasenotes.rst
@@ -24,6 +24,7 @@ https://trackme.readthedocs.io/en/latest/configuration.html
 - Fix - Issue #219 - Outliers detection - dropdown for alert on upper is not pref-filled with the actual setting of the entity
 - Fix - Issue #220 - Audit scheduling - in some environments, status=success is replaced it search time by completed (internal scheduler) which is not expected by the searches
 - Fix - Issue #221 - Data sources - Tags are not preserved following actions in the UI
+- Fix - Issue #224 - Outliers - Switching an entity between different periods may lead the outliers generation to be failing
 - Change: Icons change
 
 Version 1.2.30

diff --git a/trackme/default/macros.conf b/trackme/default/macros.conf
@@ -1013,7 +1013,9 @@ definition = mstats stdev(trackme.eventcount_4h) as stdev, avg(trackme.eventcoun
 | eval object=case(isnull(object) AND object_category="data_source", data_name, isnull(object) AND object_category="data_host", data_host, isnotnull(object), object)\
 \
 | stats first(stdev) as stdev, first(avg) as avg, first(OutlierTimePeriod) as OutlierTimePeriod, first(OutlierMinEventCount) as OutlierMinEventCount,\
-first(OutlierLowerThresholdMultiplier) as OutlierLowerThresholdMultiplier, first(OutlierUpperThresholdMultiplier) as OutlierUpperThresholdMultiplier by object_category, object
+first(OutlierLowerThresholdMultiplier) as OutlierLowerThresholdMultiplier, first(OutlierUpperThresholdMultiplier) as OutlierUpperThresholdMultiplier by object_category, object\
+\
+| where isnotnull(OutlierTimePeriod)
 args = period
 iseval = 0