https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330709#M11980 <P>I replied on your other thread. Posting same here</P> <PRE> eventtype=prd_servers sc_status!=300 sc_status!=200 sc_status!=0 | eval computerstatus=host:"-":sc_status | bin span=1m _time | stats count by _time, computerstatus | search count&gt;10 | eventstats count as occurences by computerstatus | search occurences &gt; 10 </PRE> Tue, 28 Feb 2017 14:44:57 GMT pradeepkumarg 2017-02-28T14:44:57Z https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330708#M11979 <P>I want to generate alert for the below query if it gives more than 10 results per minute for the continues 10 minutes. I can achieve it from the below query and setting the alert condition as search result equal to 10 and scheduling the alert to run on every 1 minute.</P> <P>Query - eventtype=prod_servers sc_status!=200 | eval ComputerStatus=host."-"sc_status | bucket span=1m _time | stats count as TotalErrCount by _time ComputerStatus | where TotalErrCount &gt;10 | stats value(ComputerStatus ) as ErrorCode count by _time</P> <P>But the problem is the eval field ComputerStatus comprises of many values (I.e, server1-404, server2-404, server1-500, server3-403.,,,) so in 10 minutes span I am getting result like as below</P> <P>02:27 10:01-server2-404<BR /> 02:27 10:02-server2-404<BR /> 02:27 10:03-server1-500<BR /> 02:27 10:04-server1-500<BR /> 02:27 10:05-server1-500<BR /> 02:27 10:06-server1-500<BR /> 02:27 10:07-server3-403<BR /> 02:27 10:08-server3-403<BR /> 02:27 10:09-server3-403<BR /> 02:27 10:10-server2-404</P> <P>My alert conditions are satisfied for the above results and alert getting triggered. but I want the alert to be generated if any one of the filed value count is greater than 10 per 1 minute for the continuous 10 minutes. <BR /> Example<BR /> 02:27 10:01-server2-404 OR server1-500<BR /> 02:27 10:02-server2-404 OR server1-500<BR /> 02:27 10:03-server2-404 OR server1-500<BR /> 02:27 10:04-server2-404 OR server1-500<BR /> 02:27 10:05-server2-404 OR server1-500<BR /> 02:27 10:06-server2-404 OR server1-500<BR /> 02:27 10:07-server2-404 OR server1-500<BR /> 02:27 10:08-server2-404 OR server1-500<BR /> 02:27 10:09-server2-404 OR server1-500<BR /> 02:27 10:10-server2-404 OR server1-500</P> Tue, 29 Sep 2020 13:04:02 GMT https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330708#M11979 Kwip 2020-09-29T13:04:02Z https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330709#M11980 <P>I replied on your other thread. Posting same here</P> <PRE> eventtype=prd_servers sc_status!=300 sc_status!=200 sc_status!=0 | eval computerstatus=host:"-":sc_status | bin span=1m _time | stats count by _time, computerstatus | search count&gt;10 | eventstats count as occurences by computerstatus | search occurences &gt; 10 </PRE> Tue, 28 Feb 2017 14:44:57 GMT https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330709#M11980 pradeepkumarg 2017-02-28T14:44:57Z https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330710#M11981 <P>Thank you! </P> Thu, 02 Mar 2017 05:59:13 GMT https://community.splunk.com/t5/Alerting/How-to-trigger-alert-based-on-result-filed-value-count/m-p/330710#M11981 Kwip 2017-03-02T05:59:13Z