https://community.splunk.com/t5/Alerting/Alert-when-Avg-duration-greater-than-threshold/m-p/690822#M16077 <P>Use your search in an alert and add the following</P><LI-CODE lang="markup">| where Avg &gt; 1000</LI-CODE><P>Then set the timeframe for the search to be last 15 minutes and the alert trigger to be when there are greater than zero results</P> Sun, 16 Jun 2024 08:14:26 GMT ITWhisperer 2024-06-16T08:14:26Z https://community.splunk.com/t5/Alerting/Alert-when-Avg-duration-greater-than-threshold/m-p/690818#M16076 <P>I have a query that displays avg duration. How to i modify query to alert if avg ( duration) is greater than 1000 last 15 mins.&nbsp;</P><P>index=tra cf_space_name="pr" "cf_app_name":"Sch" "msg"."Logging Duration" AND NOT "DistributedLockProcessor" |rename msg.DurationMs as TimeT |table _time TimeT msg.Service<BR />| bucket _time span=1m<BR />| stats<BR />avg(TimeT) as "Avg"<BR />by msg.Service<BR /><BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="11.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31351iBAC1B8CED2CBEB6C/image-size/large?v=v2&amp;px=999" role="button" title="11.JPG" alt="11.JPG" /></span></P> Sat, 15 Jun 2024 23:23:07 GMT https://community.splunk.com/t5/Alerting/Alert-when-Avg-duration-greater-than-threshold/m-p/690818#M16076 sivaranjani 2024-06-15T23:23:07Z https://community.splunk.com/t5/Alerting/Alert-when-Avg-duration-greater-than-threshold/m-p/690822#M16077 <P>Use your search in an alert and add the following</P><LI-CODE lang="markup">| where Avg &gt; 1000</LI-CODE><P>Then set the timeframe for the search to be last 15 minutes and the alert trigger to be when there are greater than zero results</P> Sun, 16 Jun 2024 08:14:26 GMT https://community.splunk.com/t5/Alerting/Alert-when-Avg-duration-greater-than-threshold/m-p/690822#M16077 ITWhisperer 2024-06-16T08:14:26Z