https://community.splunk.com/t5/Alerting/Unbalanced-Load-Alert/m-p/462411#M8221 <P>You can do both in One. Something like this:</P> <PRE><CODE>your current search fetching zLoad and YLoad | eval diff=zLoad-YLoad , eval type=if(diff&gt;0,"Higher","Lower") | where abs(diff)&gt;=10 </CODE></PRE> Wed, 05 Feb 2020 19:29:48 GMT somesoni2 2020-02-05T19:29:48Z https://community.splunk.com/t5/Alerting/Unbalanced-Load-Alert/m-p/462410#M8220 <P>I want to be alerted when the motor load on a machine is more than 10 higher or lower than the other motor load (they should usually be balanced and share the load evenly. Unbalanced load could lead to a failure). </P> <P>Would I essentially need to build two alerts for this? One for alerting when Z is 10 higher than Y, and another for when Z motor is 10 lower than Y? Or can it be done in one?</P> <P>If ZLoad &gt; (YLoad +10) when [tag]=STOPPED</P> Wed, 05 Feb 2020 18:10:36 GMT https://community.splunk.com/t5/Alerting/Unbalanced-Load-Alert/m-p/462410#M8220 alamo1212 2020-02-05T18:10:36Z https://community.splunk.com/t5/Alerting/Unbalanced-Load-Alert/m-p/462411#M8221 <P>You can do both in One. Something like this:</P> <PRE><CODE>your current search fetching zLoad and YLoad | eval diff=zLoad-YLoad , eval type=if(diff&gt;0,"Higher","Lower") | where abs(diff)&gt;=10 </CODE></PRE> Wed, 05 Feb 2020 19:29:48 GMT https://community.splunk.com/t5/Alerting/Unbalanced-Load-Alert/m-p/462411#M8221 somesoni2 2020-02-05T19:29:48Z