https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-threshold-for-value-by-count-current/m-p/465418#M131121 <P>I have a search using <CODE>timechart</CODE> count by [value] and I'd like to set up an alert for when any of the values reach more than 25 results in 30 minutes.</P> <P>Search:</P> <PRE><CODE>index=[redacted] ... | rex field=message "responseCode : (?&lt;response&gt;.*)," | rex field=message "errorMessageKey : (?&lt;response&gt;.*)," | timechart span=30m count by response usenull=f useother=f </CODE></PRE> <P>The response comes back like <CODE>Application.errorMessage</CODE> simple and short string.</P> <P>How can I achieve this?</P> Tue, 26 May 2020 19:56:42 GMT trever 2020-05-26T19:56:42Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-threshold-for-value-by-count-current/m-p/465418#M131121 <P>I have a search using <CODE>timechart</CODE> count by [value] and I'd like to set up an alert for when any of the values reach more than 25 results in 30 minutes.</P> <P>Search:</P> <PRE><CODE>index=[redacted] ... | rex field=message "responseCode : (?&lt;response&gt;.*)," | rex field=message "errorMessageKey : (?&lt;response&gt;.*)," | timechart span=30m count by response usenull=f useother=f </CODE></PRE> <P>The response comes back like <CODE>Application.errorMessage</CODE> simple and short string.</P> <P>How can I achieve this?</P> Tue, 26 May 2020 19:56:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-alert-threshold-for-value-by-count-current/m-p/465418#M131121 trever 2020-05-26T19:56:42Z