https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110808#M1607 <P>Add an stats command at the end of your search to get the max value of the column and alert based on its value.</P> Fri, 28 Mar 2014 13:43:32 GMT somesoni2 2014-03-28T13:43:32Z https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110807#M1606 <P>Hi Fellow Splunkers,</P> <P>I have a search which sums up the total numerical values of the columns so basically i use addcoltotals function.</P> <P>My question is what will be my conditional search to my alerts creation? Because my threshold is depends on the total of my columns using addcoltotals. Since addcoltotals is not a field in my results. Thanks...</P> Fri, 28 Mar 2014 09:29:57 GMT https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110807#M1606 leordimalanta 2014-03-28T09:29:57Z https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110808#M1607 <P>Add an stats command at the end of your search to get the max value of the column and alert based on its value.</P> Fri, 28 Mar 2014 13:43:32 GMT https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110808#M1607 somesoni2 2014-03-28T13:43:32Z https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110809#M1608 <P>Try Something like below:</P> <P>stats count by something| addcoltotals labelfield=something label=Total | eval check=if(count&gt;200, 1, 0) | search check=1</P> <P>Alert on check=1 or 0 based on your threshold as check would be a field.</P> Tue, 25 Oct 2016 10:21:29 GMT https://community.splunk.com/t5/Alerting/Addcoltotals-as-threshold-alert/m-p/110809#M1608 isha_rastogi 2016-10-25T10:21:29Z