https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84095#M12265 <P>Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday</P> Fri, 11 Jan 2013 17:51:04 GMT pdash 2013-01-11T17:51:04Z https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84093#M12263 <P>I want to have a custom condition where am comparing two fields of my search. One returns the current day (%e) and the other returns date_mday. How do I write this condition because %e has a space before it. So should it be like this?</P> <P>search currentday = " "+date_mday </P> <P>How to concatenate the space or is there a way i can get the current day without that space or a zero</P> Thu, 10 Jan 2013 18:46:03 GMT https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84093#M12263 pdash 2013-01-10T18:46:03Z https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84094#M12264 <P>Found the solution. So in this alert I wanted to compare date_mday with my Today field and trigger an alert when it happens today. Here goes the details</P> <P>The query would be:<BR /> index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | stats sum(MB) as TotalMBUsed by pool, date_mday|eval Today=trim((strftime(now(), "%e")), " ")| eval MBExceededBy = 512000 - TotalMBUsed |eval MBAvailable = 512000 |eval Environment = "DEV" |eval TriggeredOn = if((match(date_mday,Today)), "Today", date_mday)|where TotalMBUsed &gt; 512000</P> <P>Time Range is @mon to now</P> <P>Custom Condtion is "search TriggeredOn = Today"</P> <P>This would trigger the alert on the day a violation occurs and the alert table will have all the violation of that month so that you know how many violations you have done in this month.</P> Mon, 28 Sep 2020 13:05:11 GMT https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84094#M12264 pdash 2020-09-28T13:05:11Z https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84095#M12265 <P>Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday</P> Fri, 11 Jan 2013 17:51:04 GMT https://community.splunk.com/t5/Alerting/Custom-Condition-in-Alert/m-p/84095#M12265 pdash 2013-01-11T17:51:04Z