https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630094#M218898 <P>May i know what should be used in &lt;&lt;field&gt;&gt;&nbsp; because here im working with group and error_count field only, please refer image for more clarity</P><P><FONT color="#0000FF">&lt;&lt;BASE QUERY&gt;&gt; | timechart span=30m sum(error_c) as error_count by group</FONT><BR /><FONT color="#0000FF">| streamstats window=1 current=f values(*) as prev_*</FONT></P><P><FONT color="#0000FF">| foreach group* [|eval increase_group=if(group &gt; prev_group , 1, null())]</FONT></P><P><FONT color="#000000">Its just giving each group name and prev_groupname columns<BR />I tried by changing null() by 0 also</FONT></P> Wed, 08 Feb 2023 19:50:47 GMT StringBee 2023-02-08T19:50:47Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630066#M218879 <P>I want to create a alert that will notify if error_count is continuously increasing over time for any of the group mentioned in column<BR />In table I have used timechart which gives sum of error_count value for different groups over the time. I need to compare. I want query that will trigger alert when every row value is greater then its previous row for their respective column, If any column verify this condition Alert should be raised<BR /><STRONG>In Simple words : Alert when error_count increases with time for any group<BR /><BR /></STRONG>My sample query:</P> <P>&lt;&lt;BASE QUERY&gt;&gt;&nbsp;earliest=-4h@h latest=@h | timechart span=30m sum(error_count) as c by group&nbsp;<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-02-08 at 3.07.51 PM.png" style="width: 200px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23773iABBA2A0962D7E3E8/image-size/small?v=v2&amp;px=200" role="button" title="Screenshot 2023-02-08 at 3.07.51 PM.png" alt="Screenshot 2023-02-08 at 3.07.51 PM.png" /></span><BR />Result of this query is in image attached ,consider this table as sample data for Alert query</P> Wed, 08 Feb 2023 17:24:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630066#M218879 StringBee 2023-02-08T17:24:07Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630071#M218883 <P>It depends on what you mean by "continuously increasing". This might give you a starting point</P><LI-CODE lang="markup">| streamstats window=1 current=f values(*) as previous_* | foreach group* [| eval increase_&lt;&lt;FIELD&gt;&gt;=if(&lt;&lt;FIELD&gt;&gt; &gt; previous_&lt;&lt;FIELD&gt;&gt;, 1, null())]</LI-CODE> Wed, 08 Feb 2023 10:49:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630071#M218883 ITWhisperer 2023-02-08T10:49:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630076#M218887 <P><SPAN>by "continuously increasing" i mean error_count value should increase consecutively 4 times for respective column<BR />Note : Basically alert should be triggered when we get increasing value in consecutive 4 rows of column</SPAN></P> Wed, 08 Feb 2023 11:19:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630076#M218887 StringBee 2023-02-08T11:19:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630088#M218893 <LI-CODE lang="markup">| streamstats window=1 current=f values(*) as previous_* | foreach group* [| eval increase_&lt;&lt;FIELD&gt;&gt;=if(&lt;&lt;FIELD&gt;&gt; &gt; previous_&lt;&lt;FIELD&gt;&gt;, 1, null())] | streamstats window=4 sum(increase_*) as last4increase_* | eval alert=0 | foreach last4increase_* [| eval alert=if(alert == 0 and &lt;&lt;FIELD&gt;&gt; == 4, 1, alert)] | where alert == 1</LI-CODE> Wed, 08 Feb 2023 12:05:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630088#M218893 ITWhisperer 2023-02-08T12:05:50Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630094#M218898 <P>May i know what should be used in &lt;&lt;field&gt;&gt;&nbsp; because here im working with group and error_count field only, please refer image for more clarity</P><P><FONT color="#0000FF">&lt;&lt;BASE QUERY&gt;&gt; | timechart span=30m sum(error_c) as error_count by group</FONT><BR /><FONT color="#0000FF">| streamstats window=1 current=f values(*) as prev_*</FONT></P><P><FONT color="#0000FF">| foreach group* [|eval increase_group=if(group &gt; prev_group , 1, null())]</FONT></P><P><FONT color="#000000">Its just giving each group name and prev_groupname columns<BR />I tried by changing null() by 0 also</FONT></P> Wed, 08 Feb 2023 19:50:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630094#M218898 StringBee 2023-02-08T19:50:47Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630099#M218901 <P>The foreach command substitutes various special names (including &lt;&lt;FIELD&gt;&gt;) with the fields listed into the subsearch.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Foreach" target="_blank">foreach - Splunk Documentation</A></P> Wed, 08 Feb 2023 12:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630099#M218901 ITWhisperer 2023-02-08T12:58:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630408#M219015 <P>You are awesome !<BR />Thanks for help</P> Fri, 10 Feb 2023 08:20:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-alert-when-error-count-is-continuously-increasing/m-p/630408#M219015 StringBee 2023-02-10T08:20:41Z