https://community.splunk.com/t5/Alerting/Alert-condition-Continuous-failure/m-p/541489#M10249 <P>Hi,</P><P>I need an alert to be created, which should trigger only if we receive continuous failures for 5 times within a span of 10 mins.</P><P>1) Trigger alert</P><P>failure</P><P>failure</P><P>failure</P><P>failure&nbsp;</P><P>failure</P><P>&nbsp;</P><P>2) do not trigger alert</P><P>failure</P><P>failure</P><P>failure</P><P>failure</P><P>success</P><P>failure</P><P>failure</P><P>failure</P><P>failure</P><P>success</P> Fri, 26 Feb 2021 10:01:13 GMT VijaySrrie 2021-02-26T10:01:13Z https://community.splunk.com/t5/Alerting/Alert-condition-Continuous-failure/m-p/541489#M10249 <P>Hi,</P><P>I need an alert to be created, which should trigger only if we receive continuous failures for 5 times within a span of 10 mins.</P><P>1) Trigger alert</P><P>failure</P><P>failure</P><P>failure</P><P>failure&nbsp;</P><P>failure</P><P>&nbsp;</P><P>2) do not trigger alert</P><P>failure</P><P>failure</P><P>failure</P><P>failure</P><P>success</P><P>failure</P><P>failure</P><P>failure</P><P>failure</P><P>success</P> Fri, 26 Feb 2021 10:01:13 GMT https://community.splunk.com/t5/Alerting/Alert-condition-Continuous-failure/m-p/541489#M10249 VijaySrrie 2021-02-26T10:01:13Z https://community.splunk.com/t5/Alerting/Alert-condition-Continuous-failure/m-p/541490#M10250 <P>You could do something around:</P><P>&nbsp;</P><LI-CODE lang="markup">| autoregress status p=1-4 | where status = "failure" and status_p1 = "failure" and status_p2 = "failure" and status_p3 = "failure" and status_p4 = "failure"</LI-CODE><P>&nbsp;</P> Fri, 26 Feb 2021 10:13:12 GMT https://community.splunk.com/t5/Alerting/Alert-condition-Continuous-failure/m-p/541490#M10250 ITWhisperer 2021-02-26T10:13:12Z