https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68438#M943 <P>I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:</P> <P>mysearch | stats count dc(memberUid)</P> <P>condition: 0 &lt; dc(memberUid) &lt; 50</P> Mon, 11 Oct 2010 23:11:46 GMT the_wolverine 2010-10-11T23:11:46Z https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68438#M943 <P>I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:</P> <P>mysearch | stats count dc(memberUid)</P> <P>condition: 0 &lt; dc(memberUid) &lt; 50</P> Mon, 11 Oct 2010 23:11:46 GMT https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68438#M943 the_wolverine 2010-10-11T23:11:46Z https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68439#M944 <P>Try renaming your distinct count field.</P> <PRE><CODE>mysearch | stats count dc(memberUid) as dc_uid </CODE></PRE> <P>condition: <CODE>0 &lt; dc_uid &lt; 50</CODE></P> Mon, 11 Oct 2010 23:17:03 GMT https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68439#M944 ftk 2010-10-11T23:17:03Z https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68440#M945 <P>That worked. Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 11 Oct 2010 23:23:09 GMT https://community.splunk.com/t5/Alerting/Conditional-alerting-examples/m-p/68440#M945 the_wolverine 2010-10-11T23:23:09Z