https://community.splunk.com/t5/Alerting/custom-alert-for-specific-range/m-p/36041#M385 <PRE><CODE>sourcetype="access_test" -------------- | eval AllenPercentage=(Allen_hits/Total_hits)*100 as AllenPercentage | eval RcdnPercentage=(Rcdn_hits/Total_hits)*100 as RcdnPercentage | </CODE></PRE> <P>I would like to set a custom alert if RcdnPercentage reaches to 80% and AllenPercentage reaches to 20% </P> Tue, 19 Feb 2013 00:54:45 GMT sarkanth12 2013-02-19T00:54:45Z https://community.splunk.com/t5/Alerting/custom-alert-for-specific-range/m-p/36041#M385 <PRE><CODE>sourcetype="access_test" -------------- | eval AllenPercentage=(Allen_hits/Total_hits)*100 as AllenPercentage | eval RcdnPercentage=(Rcdn_hits/Total_hits)*100 as RcdnPercentage | </CODE></PRE> <P>I would like to set a custom alert if RcdnPercentage reaches to 80% and AllenPercentage reaches to 20% </P> Tue, 19 Feb 2013 00:54:45 GMT https://community.splunk.com/t5/Alerting/custom-alert-for-specific-range/m-p/36041#M385 sarkanth12 2013-02-19T00:54:45Z https://community.splunk.com/t5/Alerting/custom-alert-for-specific-range/m-p/36042#M386 <P>Add this to the end of your search:</P> <PRE><CODE>| where RcdnPercentage &gt;= .8 AND AllenPercentage &gt;= .2 </CODE></PRE> <P>Then set the Alter Condition to Number of Results &gt; 0.<BR /> That should work</P> Mon, 25 Feb 2013 13:24:26 GMT https://community.splunk.com/t5/Alerting/custom-alert-for-specific-range/m-p/36042#M386 lguinn2 2013-02-25T13:24:26Z