https://community.splunk.com/t5/Alerting/Need-help-setting-a-customized-alert/m-p/100125#M1431 <P>I have the following query:<BR /> .... | eval time_sec = round(time_taken/1000) | chart max(time_sec) as max_response_time by cs_uri_stem</P> <P>The aim of the above is to return the maximum response time of the pages mentioned in the ... section. I want this query to be scheduled to run at midnight. Also, if the max_response_time of any page in the result set is higher than a value (say xx), it should alert by sending mails.</P> <P>How do I achieve this?</P> Mon, 28 Sep 2020 11:34:21 GMT subhadipc 2020-09-28T11:34:21Z https://community.splunk.com/t5/Alerting/Need-help-setting-a-customized-alert/m-p/100125#M1431 <P>I have the following query:<BR /> .... | eval time_sec = round(time_taken/1000) | chart max(time_sec) as max_response_time by cs_uri_stem</P> <P>The aim of the above is to return the maximum response time of the pages mentioned in the ... section. I want this query to be scheduled to run at midnight. Also, if the max_response_time of any page in the result set is higher than a value (say xx), it should alert by sending mails.</P> <P>How do I achieve this?</P> Mon, 28 Sep 2020 11:34:21 GMT https://community.splunk.com/t5/Alerting/Need-help-setting-a-customized-alert/m-p/100125#M1431 subhadipc 2020-09-28T11:34:21Z https://community.splunk.com/t5/Alerting/Need-help-setting-a-customized-alert/m-p/100126#M1432 <PRE><CODE>| eval time_sec = round(time_taken/1000) | chart max(time_sec) as max_response_time by cs_uri_stem </CODE></PRE> <P><CODE>| where</CODE> <CODE>max_response_time</CODE> &gt; <CODE>xx</CODE></P> <PRE><CODE>| sendemail to="elvis@server.com,john@server.com" format=html subject=myresults server=mail.server.com` </CODE></PRE> <P>Then you saved the search and edit it in Manager &gt;&gt; Searches &amp; Reports, to set the schedule</P> Fri, 23 Mar 2012 21:50:31 GMT https://community.splunk.com/t5/Alerting/Need-help-setting-a-customized-alert/m-p/100126#M1432 MarioM 2012-03-23T21:50:31Z