https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65863#M16340 <P>Great. Thanks. Guess I missed that one. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 17 Sep 2013 19:19:02 GMT albyva 2013-09-17T19:19:02Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65861#M16338 <P>I'm using (where) to alert me if a field exceeds 80% but what I also need is to prevent it from<BR /> alerting if that field exceeds 100%. Here is what I have now:</P> <P><SEARCH_FIELD> | where bandwidth &gt; 80</SEARCH_FIELD></P> <P>How can this be adjusted to be greater than 80, but less than 100?</P> <P>Thanks,</P> Tue, 17 Sep 2013 18:22:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65861#M16338 albyva 2013-09-17T18:22:29Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65862#M16339 <P>As you can see in the documentation for <CODE>where</CODE>, that is just a simple <CODE>AND</CODE>;</P> <PRE><CODE>&lt;your_search&gt; | where bandwidth &gt; 80 AND bandwidth &lt; 100 </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where</A></P> <P>/K</P> Tue, 17 Sep 2013 19:04:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65862#M16339 kristian_kolb 2013-09-17T19:04:09Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65863#M16340 <P>Great. Thanks. Guess I missed that one. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 17 Sep 2013 19:19:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-where-Alert-parameter/m-p/65863#M16340 albyva 2013-09-17T19:19:02Z