topic Re: alert in Alerting https://community.splunk.com/t5/Alerting/alert/m-p/575996#M13261 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />i want it as 10000 milliseconds<BR />then how the query will be??</P> Tue, 23 Nov 2021 09:41:15 GMT vinod_52791 2021-11-23T09:41:15Z alert https://community.splunk.com/t5/Alerting/alert/m-p/575853#M13255 <P>I want to send an alert when&nbsp; response time &gt; 10 sec is more than 2% of total transaction in an hour<BR />could you please suggest proper query to achieve the above requirement.</P> Mon, 22 Nov 2021 11:19:12 GMT https://community.splunk.com/t5/Alerting/alert/m-p/575853#M13255 vinod_52791 2021-11-22T11:19:12Z Re: alert https://community.splunk.com/t5/Alerting/alert/m-p/575861#M13257 <LI-CODE lang="markup">| eval slow=if(response&gt;10,1,0) | bin _time span=1h | stats count sum(slow) as slow by _time | eval tooslow=100*slow/count | where tooslow&gt;2</LI-CODE> Mon, 22 Nov 2021 12:12:01 GMT https://community.splunk.com/t5/Alerting/alert/m-p/575861#M13257 ITWhisperer 2021-11-22T12:12:01Z Re: alert https://community.splunk.com/t5/Alerting/alert/m-p/575996#M13261 <P>HI&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />i want it as 10000 milliseconds<BR />then how the query will be??</P> Tue, 23 Nov 2021 09:41:15 GMT https://community.splunk.com/t5/Alerting/alert/m-p/575996#M13261 vinod_52791 2021-11-23T09:41:15Z Re: alert https://community.splunk.com/t5/Alerting/alert/m-p/576026#M13267 <P>Is your response field in milliseconds?</P> Tue, 23 Nov 2021 14:28:11 GMT https://community.splunk.com/t5/Alerting/alert/m-p/576026#M13267 ITWhisperer 2021-11-23T14:28:11Z Re: alert https://community.splunk.com/t5/Alerting/alert/m-p/576149#M13273 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>&nbsp;</P><P>Yes field in milliseconds</P> Wed, 24 Nov 2021 09:03:08 GMT https://community.splunk.com/t5/Alerting/alert/m-p/576149#M13273 vinod_52791 2021-11-24T09:03:08Z Re: alert https://community.splunk.com/t5/Alerting/alert/m-p/576155#M13274 <LI-CODE lang="markup">| eval slow=if(response&gt;10000,1,0) | bin _time span=1h | stats count sum(slow) as slow by _time | eval tooslow=100*slow/count | where tooslow&gt;2</LI-CODE> Wed, 24 Nov 2021 09:32:15 GMT https://community.splunk.com/t5/Alerting/alert/m-p/576155#M13274 ITWhisperer 2021-11-24T09:32:15Z