https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485055#M12745 <P>Hello Experts ,<BR /> I have a splunk query which is giving me average response time using the filed "process_time".<BR /> I want to create an Alert when output of this query is &gt; 2 seconds. Please advice , how I could setup this alert.<BR /> I tried multiple options they didint work. I tried to add | where process_time &gt; 2. but this option didnt work.</P> <P>query | stats avg(process_time)</P> <P>Output : <BR /> avg(process_time)<BR /> 0.07894736842105263</P> Wed, 30 Sep 2020 02:15:04 GMT kirangurram 2020-09-30T02:15:04Z https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485055#M12745 <P>Hello Experts ,<BR /> I have a splunk query which is giving me average response time using the filed "process_time".<BR /> I want to create an Alert when output of this query is &gt; 2 seconds. Please advice , how I could setup this alert.<BR /> I tried multiple options they didint work. I tried to add | where process_time &gt; 2. but this option didnt work.</P> <P>query | stats avg(process_time)</P> <P>Output : <BR /> avg(process_time)<BR /> 0.07894736842105263</P> Wed, 30 Sep 2020 02:15:04 GMT https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485055#M12745 kirangurram 2020-09-30T02:15:04Z https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485056#M12746 <P>@kirangurram <BR /> try this</P> <P><CODE>query | stats avg(process_time) as process_time | where process_time &gt; 2</CODE></P> Mon, 23 Sep 2019 13:27:11 GMT https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485056#M12746 kamlesh_vaghela 2019-09-23T13:27:11Z https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485057#M12747 <P>Hi,</P> <P>Please try below</P> <PRE><CODE>&lt;yourSearch&gt; | stats avg(process_time) as avg_process_time | where avg_process_time &gt; 2 </CODE></PRE> Mon, 23 Sep 2019 13:27:45 GMT https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485057#M12747 harsmarvania57 2019-09-23T13:27:45Z https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485058#M12748 <P>This works like a charm ... Thanks</P> Mon, 23 Sep 2019 13:38:13 GMT https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485058#M12748 kirangurram 2019-09-23T13:38:13Z https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485059#M12749 <P>This works like a charm ... Thanks</P> Mon, 23 Sep 2019 13:38:21 GMT https://community.splunk.com/t5/Alerting/Alert-Based-on-the-output-results/m-p/485059#M12749 kirangurram 2019-09-23T13:38:21Z