https://community.splunk.com/t5/Alerting/Splunk-Dashboard-and-Alert-for-traffic-distribution-comparsion/m-p/621693#M14524 <P>Want to create a Splunk alert for Servers traffic distribution. I have 100's of different type servers in each data center (like app servers, db servers etc.). I can create a dashboard and splunk alert for specific set of servers.</P><P>But here I want to create this dashboard and splunk alert on basis of datacenter.</P><P>So how I can create this type of requirement ?&nbsp;</P><P><U>Per host wise, below query I written for reference, But data center wise all hosts can i put it in one query and write ?&nbsp;</U></P><P>index=* | where host like "ANCLOPR%" | bin span=5m _time | stats count BY _time host | eventstats sum(count) as total by _time | eval percent = count / total*100 | chart values(percent) by _time host usenull=f useother=f limit=100</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 22 Nov 2022 12:15:40 GMT asplunk789 2022-11-22T12:15:40Z https://community.splunk.com/t5/Alerting/Splunk-Dashboard-and-Alert-for-traffic-distribution-comparsion/m-p/621693#M14524 <P>Want to create a Splunk alert for Servers traffic distribution. I have 100's of different type servers in each data center (like app servers, db servers etc.). I can create a dashboard and splunk alert for specific set of servers.</P><P>But here I want to create this dashboard and splunk alert on basis of datacenter.</P><P>So how I can create this type of requirement ?&nbsp;</P><P><U>Per host wise, below query I written for reference, But data center wise all hosts can i put it in one query and write ?&nbsp;</U></P><P>index=* | where host like "ANCLOPR%" | bin span=5m _time | stats count BY _time host | eventstats sum(count) as total by _time | eval percent = count / total*100 | chart values(percent) by _time host usenull=f useother=f limit=100</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 22 Nov 2022 12:15:40 GMT https://community.splunk.com/t5/Alerting/Splunk-Dashboard-and-Alert-for-traffic-distribution-comparsion/m-p/621693#M14524 asplunk789 2022-11-22T12:15:40Z https://community.splunk.com/t5/Alerting/Splunk-Dashboard-and-Alert-for-traffic-distribution-comparsion/m-p/621695#M14525 <P>Traffic distribution should be equally distributed for each server and if any difference, we can trigger an alert for specific servers not in equal distribution.</P> Tue, 22 Nov 2022 12:19:05 GMT https://community.splunk.com/t5/Alerting/Splunk-Dashboard-and-Alert-for-traffic-distribution-comparsion/m-p/621695#M14525 asplunk789 2022-11-22T12:19:05Z