https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/362125#M6373 <P>Put the condition in the query:</P> <PRE><CODE>index="confiacd" | stats avg(responsetime) as average_response | where average_response &gt; 500 </CODE></PRE> <P>Then in your alert definition set your Trigger Condition to Number of Results &gt; 0</P> Wed, 25 Apr 2018 19:10:39 GMT kmaron 2018-04-25T19:10:39Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/362124#M6372 <P>search query is: </P> <PRE><CODE>index="confiacd" | stats avg(responsetime) </CODE></PRE> <P>Now I want to setup an alert when the avg(responsetime) &gt; 500 , so where do i write this condition to setup alert.</P> Wed, 25 Apr 2018 18:56:26 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/362124#M6372 navd 2018-04-25T18:56:26Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/362125#M6373 <P>Put the condition in the query:</P> <PRE><CODE>index="confiacd" | stats avg(responsetime) as average_response | where average_response &gt; 500 </CODE></PRE> <P>Then in your alert definition set your Trigger Condition to Number of Results &gt; 0</P> Wed, 25 Apr 2018 19:10:39 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/362125#M6373 kmaron 2018-04-25T19:10:39Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/606678#M14030 <P>What does your "500" threshold mean here?&nbsp;</P> Fri, 22 Jul 2022 15:37:05 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-based-on-the-threshold-condition/m-p/606678#M14030 s-Lope678 2022-07-22T15:37:05Z