Alert based on evaluating two time ranges

nbharadwaj — Thu, 03 Mar 2011 14:30:52 GMT

I am trying to send alerts based on the following criteria:

Last 15-20 mins: Measure avg(field1) --> value1 Last 10-15 mins: Measure avg(field1) --> value2

Calculate the % change between value1 and value2:

diff = (value2-value1)*100/value1

If diff is more than X percent than I need to send an alert notification.

How can I do this in one search command?

Re: Alert based on evaluating two time ranges

sideview — Thu, 03 Mar 2011 15:50:49 GMT

In the TimeRangePicker, choose 'custom time', then go to 'advanced'.

Enter the following as your timerange.

earliest = -20min@min

latest = -10min@min

And here's a search that will work:

Then save the search, click the 'schedule this search' box, and tell splunkd that if the search returns 1 or more rows, that you want it to send you an email.

here's another different search that will work too, although you have to use the same timerange

topic Re: Alert based on evaluating two time ranges in Alerting

Alert based on evaluating two time ranges

Re: Alert based on evaluating two time ranges