https://community.splunk.com/t5/Alerting/Need-Help-on-alerts/m-p/552669#M10526 <P>Hi</P><P>I have created an alert which checks the transaction's response time, if the response time is more than 10 mins splunk will send an email alert</P><P>Here is the search query:</P><P>sourcetype="access_log" host=hostname*<BR />| eval headers=split(_raw," ")<BR />| eval username=mvindex(headers,2)<BR />| eval method=mvindex(headers,5)<BR />| eval Request=mvindex(headers,6)<BR />| eval Status=mvindex(headers,8)<BR />| eval Payload=mvindex(headers,9)<BR />| eval req_time=mvindex(headers,10)<BR />| eval uri=mvindex(headers,11)<BR />| eval Method=replace(method,"\"","")<BR />| eval uri=replace(uri,"\"","")<BR />| eval RequestTime_Minutes = req_time*0.0000166667<BR />| eval Response_Time_in_Minutes= round(RequestTime_Minutes,2) | table Response_Time_in_Minutes host username _time uri Request Status<BR />| search Response_Time_in_Minutes &gt; 10</P><P>&nbsp;</P><P>My Question:</P><P>I want to exclude 1 particular transaction:</P><P>"searchrequest-excel-all-fields"</P><P><BR />I do not want the alerts if its the above mentioned transaction since it doesn't affect our app in any way, how do i go about it?</P><P>&nbsp;</P> Mon, 24 May 2021 03:39:52 GMT praneethlekkala 2021-05-24T03:39:52Z https://community.splunk.com/t5/Alerting/Need-Help-on-alerts/m-p/552669#M10526 <P>Hi</P><P>I have created an alert which checks the transaction's response time, if the response time is more than 10 mins splunk will send an email alert</P><P>Here is the search query:</P><P>sourcetype="access_log" host=hostname*<BR />| eval headers=split(_raw," ")<BR />| eval username=mvindex(headers,2)<BR />| eval method=mvindex(headers,5)<BR />| eval Request=mvindex(headers,6)<BR />| eval Status=mvindex(headers,8)<BR />| eval Payload=mvindex(headers,9)<BR />| eval req_time=mvindex(headers,10)<BR />| eval uri=mvindex(headers,11)<BR />| eval Method=replace(method,"\"","")<BR />| eval uri=replace(uri,"\"","")<BR />| eval RequestTime_Minutes = req_time*0.0000166667<BR />| eval Response_Time_in_Minutes= round(RequestTime_Minutes,2) | table Response_Time_in_Minutes host username _time uri Request Status<BR />| search Response_Time_in_Minutes &gt; 10</P><P>&nbsp;</P><P>My Question:</P><P>I want to exclude 1 particular transaction:</P><P>"searchrequest-excel-all-fields"</P><P><BR />I do not want the alerts if its the above mentioned transaction since it doesn't affect our app in any way, how do i go about it?</P><P>&nbsp;</P> Mon, 24 May 2021 03:39:52 GMT https://community.splunk.com/t5/Alerting/Need-Help-on-alerts/m-p/552669#M10526 praneethlekkala 2021-05-24T03:39:52Z https://community.splunk.com/t5/Alerting/Need-Help-on-alerts/m-p/552695#M10527 <P>Try adding&nbsp;</P><LI-CODE lang="markup">AND NOT "searchrequest-excel-all-fields"</LI-CODE><P>to your final search</P> Mon, 24 May 2021 06:55:11 GMT https://community.splunk.com/t5/Alerting/Need-Help-on-alerts/m-p/552695#M10527 ITWhisperer 2021-05-24T06:55:11Z