https://community.splunk.com/t5/Alerting/Custom-request-on-Splunk-alerting/m-p/172909#M12376 <P>What am i looking for: My search results contains Count field.</P> <P>1) if Count greater than Zero should alert once and after alerting once it shouldn't alert till 00:00 AM. (I am writing results from 1st alert in a csv file)</P> <P>2) if number increases by 5 from that of no. in CSV (csv+5), i should trigger an alert once and after alerting once it shouldn't alert till 00:00 AM</P> <P>3) if number increases by 10 from that of no. in CSV (Csv+10), i should trigger an alert once and after alerting once it shouldnot alert till 00:00AM</P> <P>I have to run the query for every 15 min.</P> Thu, 13 Aug 2015 10:25:10 GMT manja054 2015-08-13T10:25:10Z https://community.splunk.com/t5/Alerting/Custom-request-on-Splunk-alerting/m-p/172909#M12376 <P>What am i looking for: My search results contains Count field.</P> <P>1) if Count greater than Zero should alert once and after alerting once it shouldn't alert till 00:00 AM. (I am writing results from 1st alert in a csv file)</P> <P>2) if number increases by 5 from that of no. in CSV (csv+5), i should trigger an alert once and after alerting once it shouldn't alert till 00:00 AM</P> <P>3) if number increases by 10 from that of no. in CSV (Csv+10), i should trigger an alert once and after alerting once it shouldnot alert till 00:00AM</P> <P>I have to run the query for every 15 min.</P> Thu, 13 Aug 2015 10:25:10 GMT https://community.splunk.com/t5/Alerting/Custom-request-on-Splunk-alerting/m-p/172909#M12376 manja054 2015-08-13T10:25:10Z https://community.splunk.com/t5/Alerting/Custom-request-on-Splunk-alerting/m-p/172910#M12377 <P>I would try</P> <P>...your search... </P> <PRE><CODE>| eval ts=strftime(_time, "%x") | fields ts | lookup your_search_key ts OUTPUTNEW count_from_ts | eval count_from_csv=if(isnull(count_from_csv),-4.count_from_csv) | eval new=if(count&gt;=count_from_csv+5,1,0) | search new=1 </CODE></PRE> Thu, 13 Aug 2015 13:43:08 GMT https://community.splunk.com/t5/Alerting/Custom-request-on-Splunk-alerting/m-p/172910#M12377 FritzWittwer_ol 2015-08-13T13:43:08Z