https://community.splunk.com/t5/Alerting/Log-correlation-and-alerts/m-p/69158#M957 <P>Yes that's a standard alert setting and you can have it alert with Seperated counts for each service. <BR /> See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Alertexamples">http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Alertexamples</A></P> Wed, 19 Dec 2012 22:46:53 GMT BobM 2012-12-19T22:46:53Z https://community.splunk.com/t5/Alerting/Log-correlation-and-alerts/m-p/69157#M956 <P>Hi,</P> <P>I'm looking to know if the following is supported Out of the box, or if it is achievable on Splunk platform.</P> <P>My client want's the monitoring system to send an alert only when there is more than 9 messages with the level "WARN" for the service "A" within a given interval of time. The system should make such evaluation each time a log with the level "WARN" for service "A" if fired.</P> <P>Regards,</P> Wed, 19 Dec 2012 22:00:09 GMT https://community.splunk.com/t5/Alerting/Log-correlation-and-alerts/m-p/69157#M956 hveillette 2012-12-19T22:00:09Z https://community.splunk.com/t5/Alerting/Log-correlation-and-alerts/m-p/69158#M957 <P>Yes that's a standard alert setting and you can have it alert with Seperated counts for each service. <BR /> See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Alertexamples">http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Alertexamples</A></P> Wed, 19 Dec 2012 22:46:53 GMT https://community.splunk.com/t5/Alerting/Log-correlation-and-alerts/m-p/69158#M957 BobM 2012-12-19T22:46:53Z