Alerting

Add Alert for Dashboard Panel

tkwaller
Builder

Hello

I'm trying to add an alert to a dashboard panel: here is the base search:
index=name app_name=API brokerId=* operation=purchase earliest=-4h | xmlkv | timechart span=10min count by transactionType | eval NRTPCT=(NonRealTime/(RealTime+NonRealTime))*100 | eval RTPCT=(RealTime/(RealTime+NonRealTime))*100

What I would like to alert on is when the NRTPCT goes over 2%

I haven't figured out the conditional search for the alert to use.

Can anyone help?

Tags (1)
0 Karma
1 Solution

tkwaller
Builder

Nevermind, changed the base search, added a new field for eval and used that field to determine the conditional search for the alert.

View solution in original post

0 Karma

tkwaller
Builder

Nevermind, changed the base search, added a new field for eval and used that field to determine the conditional search for the alert.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...