Splunk Alert Setup

csridhar — Tue, 02 Feb 2021 17:34:12 GMT

Hello Everyone,

I need a help in setting up Splunk Alert to generate an alert if we get 60 errors per minute over a 5 minute period

Re: Splunk Alert Setup

richgalloway — Tue, 02 Feb 2021 19:35:51 GMT

Perhaps this will get you started.

index=foo earliest=-5m ERROR ```Group events by the minute``` | bin span=1m _time ```Count how many occurred each minute``` | stats count by _time ```Keep only the minutes where the count was 60 | where count=60 ```Count how many minutes are represented``` | stats count ```Return results if all 5 minutes have 60 errors``` | where count=5

topic Splunk Alert Setup in Alerting

Splunk Alert Setup

Re: Splunk Alert Setup