https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577142#M15734 <P>Will what you show only trigger when the phrase "Please Investigate" appears in the alert? I don't want to see the alert if there is 0.00 latency</P> Thu, 02 Dec 2021 20:34:31 GMT babcolee 2021-12-02T20:34:31Z https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577133#M15732 <P>I have an alert set up to run every hour to look for any latency of :45 minutes. If over that send a "Please Investigate" message</P><P>Index=...&nbsp; | stats count max(_time) as lastTime by host<BR />| eval now=now()<BR />| eval timedelta=round((now-lastTime)/60/60,2)<BR />| eval timedelta=if(timedelta &gt; .75,"Please Investigate", timedelta)<BR />| convert ctime(lastTime) ctime(now)<BR />| sort - timedelta</P><P>The problem is that I get this alert email even when the latency is 0.00. What I really need is for the alert to trigger and run when it sees the phrase "Please Investigate" . I have been unsuccessful in setting this up in the Splunk Alert GUI as a trigger.</P><P>&nbsp;</P> Thu, 02 Dec 2021 20:10:24 GMT https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577133#M15732 babcolee 2021-12-02T20:10:24Z https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577137#M15733 <P>Why not leave it in minutes?</P><LI-CODE lang="markup">Index=... | stats count max(_time) as lastTime by host | eval now=now() | eval timedelta=(now-lastTime)/60 | eval timedelta=if(timedelta &gt; 45,"Please Investigate", timedelta) | convert ctime(lastTime) ctime(now) | where timedelta="Please Investigate"</LI-CODE> Thu, 02 Dec 2021 20:23:54 GMT https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577137#M15733 ITWhisperer 2021-12-02T20:23:54Z https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577142#M15734 <P>Will what you show only trigger when the phrase "Please Investigate" appears in the alert? I don't want to see the alert if there is 0.00 latency</P> Thu, 02 Dec 2021 20:34:31 GMT https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577142#M15734 babcolee 2021-12-02T20:34:31Z https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577144#M15735 <P>You have to make sure that:</P><UL><LI>the alert is configured to trigger only when the number of results is greater than 0.</LI><LI>your search query is actually filtering out results that you don't want alerted on. Per&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<UL><LI><PRE>| where timedelta="Please Investigate"</PRE></LI></UL></LI></UL><P>&nbsp;</P> Thu, 02 Dec 2021 21:21:34 GMT https://community.splunk.com/t5/Security/Splunk-Alert-on-specific-phrase/m-p/577144#M15735 johnhuang 2021-12-02T21:21:34Z