https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334022#M11976 <P>I want the alert to trigger if RespCode of 60 is greater than 3%. </P> Fri, 03 Mar 2017 14:31:27 GMT jephillips 2017-03-03T14:31:27Z https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334020#M11974 <P>I'm looking for a way to setup a customer trigger for the below search. Basically I need the alert to go off if RespCode=60 is greater than 3%. When I try entering percentage as the Customer trigger Splunk says "In handler 'savedsearch': Cannot parse alert condition. Unknown search command 'percentage'." I uploaded a pic of the results if that helps. </P> <P>index=main sourcetype=ivr host=apcv* card_validation response=* | stats count by RespCode | eventstats sum(count) as TotalofAllRespCodes | eval percentage=(count/TotalofAllRespCodes*100) | search RespCode=60</P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2578i7E5C028589BE5CF8/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> Thu, 02 Mar 2017 18:48:39 GMT https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334020#M11974 jephillips 2017-03-02T18:48:39Z https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334021#M11975 <P>What condition are you alerting on exactly? What is the alert criteria?</P> Fri, 03 Mar 2017 06:21:17 GMT https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334021#M11975 burwell 2017-03-03T06:21:17Z https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334022#M11976 <P>I want the alert to trigger if RespCode of 60 is greater than 3%. </P> Fri, 03 Mar 2017 14:31:27 GMT https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334022#M11976 jephillips 2017-03-03T14:31:27Z https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334023#M11977 <P>Based on the table you provided, you could add a <CODE>|where percentage &gt; 3</CODE> at the end of your search.</P> Fri, 03 Mar 2017 14:41:30 GMT https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334023#M11977 adayton20 2017-03-03T14:41:30Z https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334024#M11978 <P>Thanks. I do believe that will do it. I was over complicating things apparently. </P> Fri, 03 Mar 2017 15:10:22 GMT https://community.splunk.com/t5/Alerting/Customer-trigger-for-alerts/m-p/334024#M11978 jephillips 2017-03-03T15:10:22Z