topic Re: How to create an alert if field value remains above a specific threshold? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437296#M124526 <P>Hi Nickhillscpl,</P> <P>Thank you for the query, it's not quite giving me the results I'm looking for. I've updated my query to the following: </P> <P>| makeresults<BR /> | stats count by _time<BR /> | eval lock_count=case(count&gt;500,"alert")<BR /> | search lock_count=alert<BR /> | bin _time span=5m <BR /> | streamstats count window=2 by lock_alert</P> <P>Now trying to resolve, if I get two "alerts" in a 5 min time-frame I can generate an alert. Any suggestions?</P> Tue, 29 Sep 2020 23:41:06 GMT cquinney 2020-09-29T23:41:06Z How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437292#M124522 <P>Greetings</P> <P>I'm looking to create an alert if a field value consecutively remains above a specific threshold, say 500. For example:</P> <PRE><CODE>Time Field-1 1310 583 1315 678 1320 300 1325 789 </CODE></PRE> <P>In this example, I would get an alert at 1315 but not at 1320 or 1325 as the value was not above 500 consecutively. Any help in resolving this is greatly appreciated.</P> Mon, 11 Mar 2019 22:50:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437292#M124522 cquinney 2019-03-11T22:50:55Z Re: How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437293#M124523 <P>There are a few ways to go about this and the optimal solution depends on specifics of your data.</P> <P>Do the events come in every five minutes or is that just an example?</P> Mon, 11 Mar 2019 23:48:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437293#M124523 zonistj 2019-03-11T23:48:25Z Re: How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437294#M124524 <P>The data currently comes in every 5 mins. </P> Tue, 12 Mar 2019 11:22:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437294#M124524 cquinney 2019-03-12T11:22:29Z Re: How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437295#M124525 <P>Hi @cquinney </P> <P>Try this:</P> <PRE><CODE>[your search] |dedup 2 sourcetype |where Field-1&gt;500 |eventstats count|where count&gt;1|table Time Field-1 </CODE></PRE> <P>This will look at the last two consecutive events, and only include them when the value is &gt; 500.<BR /> Then eventstats counts how many records you have - more than 1 records, and you get a result</P> Tue, 12 Mar 2019 11:34:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437295#M124525 nickhills 2019-03-12T11:34:55Z Re: How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437296#M124526 <P>Hi Nickhillscpl,</P> <P>Thank you for the query, it's not quite giving me the results I'm looking for. I've updated my query to the following: </P> <P>| makeresults<BR /> | stats count by _time<BR /> | eval lock_count=case(count&gt;500,"alert")<BR /> | search lock_count=alert<BR /> | bin _time span=5m <BR /> | streamstats count window=2 by lock_alert</P> <P>Now trying to resolve, if I get two "alerts" in a 5 min time-frame I can generate an alert. Any suggestions?</P> Tue, 29 Sep 2020 23:41:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437296#M124526 cquinney 2020-09-29T23:41:06Z Re: How to create an alert if field value remains above a specific threshold? https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437297#M124527 <P>I found an alternate solution by modifying my query to:</P> <P>| makeresults<BR /> | timechart span=5min count<BR /> | eval hour=strftime(_time,"%H:%M")<BR /> | streamstats current=f window=2 last(count) as last_count<BR /> | table hour count last_count</P> <P>Then I created an alert condition where count &gt; 500 AND last_count &gt; 500</P> Tue, 29 Sep 2020 23:41:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-if-field-value-remains-above-a-specific/m-p/437297#M124527 cquinney 2020-09-29T23:41:11Z