https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42052#M9783 <P>I've set up a simple search for flapping interfaces on our switches, looks like so:</P> <PRE><CODE> LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host </CODE></PRE> <P>What I'd like to do is get an alert using a conditional ... stats count by host &gt; 5 in fifteen minutes or something like that. When I try this out it returns no data:</P> <PRE><CODE> LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host &gt; 5 </CODE></PRE> <P>How do I get from there to where I want to be?</P> Thu, 29 Dec 2011 19:24:05 GMT mikeely 2011-12-29T19:24:05Z https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42052#M9783 <P>I've set up a simple search for flapping interfaces on our switches, looks like so:</P> <PRE><CODE> LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host </CODE></PRE> <P>What I'd like to do is get an alert using a conditional ... stats count by host &gt; 5 in fifteen minutes or something like that. When I try this out it returns no data:</P> <PRE><CODE> LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host &gt; 5 </CODE></PRE> <P>How do I get from there to where I want to be?</P> Thu, 29 Dec 2011 19:24:05 GMT https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42052#M9783 mikeely 2011-12-29T19:24:05Z https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42053#M9784 <PRE><CODE>LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host | where count &gt; 5 </CODE></PRE> Thu, 29 Dec 2011 19:34:24 GMT https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42053#M9784 gkanapathy 2011-12-29T19:34:24Z https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42054#M9785 <P>It looks like it should work but still "No results found" which is strange, when I take out the where clause, there are a couple values above five.</P> Thu, 29 Dec 2011 19:37:50 GMT https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42054#M9785 mikeely 2011-12-29T19:37:50Z https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42055#M9786 <P>sorry, should be <CODE>count &gt; 5</CODE>, not <CODE>host</CODE>. editing to fix.</P> Thu, 29 Dec 2011 20:20:15 GMT https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42055#M9786 gkanapathy 2011-12-29T20:20:15Z https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42056#M9787 <P>One would think I could have tried that myself but I've apparently got too many hats on today to be any good at one thing. Thanks!</P> Thu, 29 Dec 2011 20:43:53 GMT https://community.splunk.com/t5/Splunk-Search/Simple-stats-conditional-for-alert/m-p/42056#M9787 mikeely 2011-12-29T20:43:53Z