https://community.splunk.com/t5/Other-Usage/How-to-raise-alert-when-threshold-exceeded-and-alert-when/m-p/644223#M529 <P>Hi,</P> <P>I'm looking for a way to raise an alert in Splunk when the number of errors for a given event exceeds a set threshold within a set period of time - for example &gt;10 events in a 5 minute period (alert raised). It must only be raised once.</P> <P>I then want another alert to be raised when that previous alert no longer applies (alert over) - for example there are now 0 events in a 5 minute period. This also must only be raised once.</P> <P>If, subsequently, the first alert is triggered again, then it will alert and so on, toggling between alert raised and alert over.</P> <P>Any help would be much appreciated as I can't find any info on how I might go about this.</P> <P>Thanks in advance.</P> <P>Phil Hamer</P> Tue, 23 May 2023 13:35:39 GMT hamerp 2023-05-23T13:35:39Z https://community.splunk.com/t5/Other-Usage/How-to-raise-alert-when-threshold-exceeded-and-alert-when/m-p/644223#M529 <P>Hi,</P> <P>I'm looking for a way to raise an alert in Splunk when the number of errors for a given event exceeds a set threshold within a set period of time - for example &gt;10 events in a 5 minute period (alert raised). It must only be raised once.</P> <P>I then want another alert to be raised when that previous alert no longer applies (alert over) - for example there are now 0 events in a 5 minute period. This also must only be raised once.</P> <P>If, subsequently, the first alert is triggered again, then it will alert and so on, toggling between alert raised and alert over.</P> <P>Any help would be much appreciated as I can't find any info on how I might go about this.</P> <P>Thanks in advance.</P> <P>Phil Hamer</P> Tue, 23 May 2023 13:35:39 GMT https://community.splunk.com/t5/Other-Usage/How-to-raise-alert-when-threshold-exceeded-and-alert-when/m-p/644223#M529 hamerp 2023-05-23T13:35:39Z