topic Re: Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert? in Alerting

Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

B83896 — Tue, 21 Jun 2016 09:11:32 GMT

Hi,

I am using the following search for monitoring number of Threads on a server:

index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date

and I want to set up an alert to be triggered when conditions are met (custom alert): Threads > 1600. But Splunk does not allow me to specify this condition in the alert "threads > 1600".

Could you please help me in resolving this? Thanks,

Re: Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

renjith_nair — Tue, 21 Jun 2016 10:06:45 GMT

Try providing the condition as search Threads > 1600 in the condition box.
Another way to do is including the condition in the search itself and alert when Number of Resultsis greater than '0'

index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date|search Threads > 1600

and then selecting the drop down Number of Results is greater than 0

Re: Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

B83896 — Tue, 21 Jun 2016 12:27:36 GMT

Hello,
Great! Thanks - first option worked for me!

Re: Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

renjith_nair — Tue, 21 Jun 2016 14:11:59 GMT

Good to know. Please accept as answer so that the thread will be closed

Re: Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

B83896 — Tue, 21 Jun 2016 14:22:15 GMT

Done, thank you!