https://community.splunk.com/t5/Alerting/How-to-trigger-a-query-when-an-alert-is-triggered/m-p/585474#M13490 <P>Build the growth calculation into the alert search such that the alert is only triggered based on both the backlog and the growth</P> Thu, 17 Feb 2022 06:55:46 GMT ITWhisperer 2022-02-17T06:55:46Z https://community.splunk.com/t5/Alerting/How-to-trigger-a-query-when-an-alert-is-triggered/m-p/585470#M13489 <P>My requirement is to get the rate of change of a certain parameter if its corresponding alert gets triggered.<BR />To add more details, we have a log file that logs the backlog of database. Once the backlog crosses a certain threshold we trigger an alert, however it could be a false positive since the system may be undergoing maintenance and hence backlog grows.<BR />So I want the alert to trigger another query that captures rate of growth over the last 'x' hours.<BR />This will give more context about what is happening in the system.<BR />How to achieve this in splunk? Please share your ideas</P> Thu, 17 Feb 2022 16:03:00 GMT https://community.splunk.com/t5/Alerting/How-to-trigger-a-query-when-an-alert-is-triggered/m-p/585470#M13489 ashwinve1385 2022-02-17T16:03:00Z https://community.splunk.com/t5/Alerting/How-to-trigger-a-query-when-an-alert-is-triggered/m-p/585474#M13490 <P>Build the growth calculation into the alert search such that the alert is only triggered based on both the backlog and the growth</P> Thu, 17 Feb 2022 06:55:46 GMT https://community.splunk.com/t5/Alerting/How-to-trigger-a-query-when-an-alert-is-triggered/m-p/585474#M13490 ITWhisperer 2022-02-17T06:55:46Z