https://community.splunk.com/t5/Splunk-Search/Alarm-Condition-Creation/m-p/75403#M19060 <P>Hi daniel333,</P> <P>If you create a new Alert through the management interface(Manager =&gt; Searches and Reports =&gt; Add New). It will allow you to set the Alert Condition, where you can choose "if number of events" then "is greater than".</P> <P>It will step you through all of the process. I hope that this is what you are looking for.</P> <P>Regards Vince</P> Wed, 27 Mar 2013 03:01:08 GMT vincesesto 2013-03-27T03:01:08Z https://community.splunk.com/t5/Splunk-Search/Alarm-Condition-Creation/m-p/75402#M19059 <P>All, </P> <P>I have this search which when done displays the ipaddress of people and the number of hits they made against our site. We found that people going over 1000 hits per minute were generally fraud. </P> <P>index=apache_access_logs host=apache* /myapi/myevent| timechart count by clientip</P> <P>I'd like the results of that search sent to me when a clienip exceeds 1000 in a minutes time. </P> <P>How do I loop through the results and run a condution of where &gt; 1000? </P> Mon, 28 Sep 2020 13:36:58 GMT https://community.splunk.com/t5/Splunk-Search/Alarm-Condition-Creation/m-p/75402#M19059 daniel333 2020-09-28T13:36:58Z https://community.splunk.com/t5/Splunk-Search/Alarm-Condition-Creation/m-p/75403#M19060 <P>Hi daniel333,</P> <P>If you create a new Alert through the management interface(Manager =&gt; Searches and Reports =&gt; Add New). It will allow you to set the Alert Condition, where you can choose "if number of events" then "is greater than".</P> <P>It will step you through all of the process. I hope that this is what you are looking for.</P> <P>Regards Vince</P> Wed, 27 Mar 2013 03:01:08 GMT https://community.splunk.com/t5/Splunk-Search/Alarm-Condition-Creation/m-p/75403#M19060 vincesesto 2013-03-27T03:01:08Z