https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48993#M652 <PRE><CODE>| stats count | where count&gt;0 </CODE></PRE> Mon, 13 Sep 2010 20:58:54 GMT ziegfried 2010-09-13T20:58:54Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48992#M651 <P>I am using the Manager to set-up a saved search/alert. Splunk runs a script every so often with an output like this:</P> <PRE><CODE>Active channel: primary channel </CODE></PRE> <P>If "primary" ever changes to "backup", it alerts us via e-mail. "primary" is in a field called "ent_status". </P> <P>In the manager, I created a search like this:</P> <PRE><CODE>sourcetype="echk" ent_channel=backup </CODE></PRE> <P>Using the menus-for-dummies, I told it "if number of events is greater than 0", send us an e-mail. Works great.</P> <P>But now I may be using a third party app to throttle the alerts (see my other question from earlier this morning). I need to re-format my alert to put into the "if custom condition is met" field. </P> <P>I'm having trouble doing this because "ent_channel" isn't an integer; I don't know how to do a compare. How do I translate "if number of events is greater than zero" into a search/alert command? </P> <P>I have the feeling I'm making this harder than it really is. </P> <P>Thank you very much. </P> Mon, 13 Sep 2010 20:43:21 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48992#M651 Branden 2010-09-13T20:43:21Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48993#M652 <PRE><CODE>| stats count | where count&gt;0 </CODE></PRE> Mon, 13 Sep 2010 20:58:54 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48993#M652 ziegfried 2010-09-13T20:58:54Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48994#M653 <P>Now that was easy, heh. Thanks!</P> Mon, 13 Sep 2010 21:21:19 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/48994#M653 Branden 2010-09-13T21:21:19Z