topic Re: How do search and trigger an alert for elevated values over a certain time frame? in Alerting https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256977#M4759 <P>Hi.. you should be able to use the standard "Schedule and alert" options. .. run your search every min and set the condition to "if number of events -&gt; is greater then -&gt;0" and alert mode "once per search" <BR /> something like below should work:<BR /> <CODE>... | bucket _time span=10m | stats avg(time_taken) as ttkn| where ttkn &gt;= 5000</CODE></P> Fri, 02 Oct 2015 17:15:19 GMT Yasaswy 2015-10-02T17:15:19Z How do search and trigger an alert for elevated values over a certain time frame? https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256976#M4758 <P>I would like to configure alerting for elevated values over time.</P> <P>For example, if avg(time_taken)&gt;=5000 for 10 mins or more, this would trigger an alert.</P> <P>This is to avoid alerts being generated for one time spikes.</P> <P>What would be the best way to accomplish such a condition?</P> <P>Any help is much appreciated!!</P> Fri, 02 Oct 2015 16:45:40 GMT https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256976#M4758 jlim2003 2015-10-02T16:45:40Z Re: How do search and trigger an alert for elevated values over a certain time frame? https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256977#M4759 <P>Hi.. you should be able to use the standard "Schedule and alert" options. .. run your search every min and set the condition to "if number of events -&gt; is greater then -&gt;0" and alert mode "once per search" <BR /> something like below should work:<BR /> <CODE>... | bucket _time span=10m | stats avg(time_taken) as ttkn| where ttkn &gt;= 5000</CODE></P> Fri, 02 Oct 2015 17:15:19 GMT https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256977#M4759 Yasaswy 2015-10-02T17:15:19Z Re: How do search and trigger an alert for elevated values over a certain time frame? https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256978#M4760 <P>This works great. I looked up the bucket command and it suits my needs.</P> <P>Thank you!</P> Fri, 02 Oct 2015 17:46:38 GMT https://community.splunk.com/t5/Alerting/How-do-search-and-trigger-an-alert-for-elevated-values-over-a/m-p/256978#M4760 jlim2003 2015-10-02T17:46:38Z