Is it possible to create a log threshold condition that triggers if event.keyword is apConnectionLost OR event.keyword is apConnected? The UI is only allowing the AND operation.
WHEN THE count OF LOG ENTRIES
WITH event.keyword IS apConnectionLost
AND event.keyword IS apConnected <==== Looking for OR
IS more than or equals 1
FOR THE LAST 10 minutes
GROUP BY apName.keyword