https://community.splunk.com/t5/Alerting/Add-Alert-for-Dashboard-Panel/m-p/125984#M1973 <P>Hello</P> <P>I'm trying to add an alert to a dashboard panel: here is the base search:<BR /> index=name app_name=API brokerId=* operation=purchase earliest=-4h | xmlkv | timechart span=10min count by transactionType | eval NRTPCT=(NonRealTime/(RealTime+NonRealTime))*100 | eval RTPCT=(RealTime/(RealTime+NonRealTime))*100</P> <P>What I would like to alert on is when the NRTPCT goes over 2%</P> <P>I haven't figured out the conditional search for the alert to use.</P> <P>Can anyone help?</P> Mon, 28 Sep 2020 16:21:13 GMT tkwaller 2020-09-28T16:21:13Z https://community.splunk.com/t5/Alerting/Add-Alert-for-Dashboard-Panel/m-p/125984#M1973 <P>Hello</P> <P>I'm trying to add an alert to a dashboard panel: here is the base search:<BR /> index=name app_name=API brokerId=* operation=purchase earliest=-4h | xmlkv | timechart span=10min count by transactionType | eval NRTPCT=(NonRealTime/(RealTime+NonRealTime))*100 | eval RTPCT=(RealTime/(RealTime+NonRealTime))*100</P> <P>What I would like to alert on is when the NRTPCT goes over 2%</P> <P>I haven't figured out the conditional search for the alert to use.</P> <P>Can anyone help?</P> Mon, 28 Sep 2020 16:21:13 GMT https://community.splunk.com/t5/Alerting/Add-Alert-for-Dashboard-Panel/m-p/125984#M1973 tkwaller 2020-09-28T16:21:13Z https://community.splunk.com/t5/Alerting/Add-Alert-for-Dashboard-Panel/m-p/125985#M1974 <P>Nevermind, changed the base search, added a new field for eval and used that field to determine the conditional search for the alert.</P> Thu, 10 Apr 2014 12:52:35 GMT https://community.splunk.com/t5/Alerting/Add-Alert-for-Dashboard-Panel/m-p/125985#M1974 tkwaller 2014-04-10T12:52:35Z