https://community.splunk.com/t5/Alerting/Alert-when-Search-runs-too-long/m-p/136096#M2196 <P>Something like this to get you started:</P> <PRE><CODE>index = _* sourcetype=audittrail info!=canceled | stats list(info) min(_time) as min max(_time) as max list(total_run_time) list(search) by search_id user </CODE></PRE> <P>You can adjust a bit to get your alert.</P> Wed, 11 Feb 2015 23:05:52 GMT thomrs 2015-02-11T23:05:52Z https://community.splunk.com/t5/Alerting/Alert-when-Search-runs-too-long/m-p/136095#M2195 <P>I was wondering if there was a way to have an alert sent to an email address, after a Splunk search has been running for over a certain duration of time?</P> Wed, 11 Feb 2015 21:23:17 GMT https://community.splunk.com/t5/Alerting/Alert-when-Search-runs-too-long/m-p/136095#M2195 mmcve 2015-02-11T21:23:17Z https://community.splunk.com/t5/Alerting/Alert-when-Search-runs-too-long/m-p/136096#M2196 <P>Something like this to get you started:</P> <PRE><CODE>index = _* sourcetype=audittrail info!=canceled | stats list(info) min(_time) as min max(_time) as max list(total_run_time) list(search) by search_id user </CODE></PRE> <P>You can adjust a bit to get your alert.</P> Wed, 11 Feb 2015 23:05:52 GMT https://community.splunk.com/t5/Alerting/Alert-when-Search-runs-too-long/m-p/136096#M2196 thomrs 2015-02-11T23:05:52Z