https://community.splunk.com/t5/Alerting/alert/m-p/575881#M13258 <P>Remove the "%" from successrate.&nbsp; Add <FONT face="courier new,courier">| where successrate &lt; 98</FONT> to the end of the query.&nbsp; If necessary, you can use an <FONT face="courier new,courier">eval</FONT> after that to put the "%" back.&nbsp; Configure the alert to trigger if there are more than zero results returned by the query.</P> Mon, 22 Nov 2021 14:06:38 GMT richgalloway 2021-11-22T14:06:38Z https://community.splunk.com/t5/Alerting/alert/m-p/575841#M13252 <P>HI&nbsp;<BR /><BR />i am getting below response from my Splunk query, please refer below screenshot<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="vinod_52791_0-1637575852875.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16949iB82DA1A7C98C1DF4/image-size/medium?v=v2&amp;px=400" role="button" title="vinod_52791_0-1637575852875.png" alt="vinod_52791_0-1637575852875.png" /></span></P><P>If you see the above screenshot you can see the result is 92.20%,my requirement is i need to send an alert when ever the percentage is below98.00%<BR /><BR />so could you please suggest proper query in order to trigger an alert when ever the result from query is below 98.00% in a time frame of 1 hour</P> Mon, 22 Nov 2021 10:14:08 GMT https://community.splunk.com/t5/Alerting/alert/m-p/575841#M13252 vinod_52791 2021-11-22T10:14:08Z https://community.splunk.com/t5/Alerting/alert/m-p/575881#M13258 <P>Remove the "%" from successrate.&nbsp; Add <FONT face="courier new,courier">| where successrate &lt; 98</FONT> to the end of the query.&nbsp; If necessary, you can use an <FONT face="courier new,courier">eval</FONT> after that to put the "%" back.&nbsp; Configure the alert to trigger if there are more than zero results returned by the query.</P> Mon, 22 Nov 2021 14:06:38 GMT https://community.splunk.com/t5/Alerting/alert/m-p/575881#M13258 richgalloway 2021-11-22T14:06:38Z