Alerting

Add Alert for Dashboard Panel

tkwaller
Builder

Hello

I'm trying to add an alert to a dashboard panel: here is the base search:
index=name app_name=API brokerId=* operation=purchase earliest=-4h | xmlkv | timechart span=10min count by transactionType | eval NRTPCT=(NonRealTime/(RealTime+NonRealTime))*100 | eval RTPCT=(RealTime/(RealTime+NonRealTime))*100

What I would like to alert on is when the NRTPCT goes over 2%

I haven't figured out the conditional search for the alert to use.

Can anyone help?

Tags (1)
0 Karma
1 Solution

tkwaller
Builder

Nevermind, changed the base search, added a new field for eval and used that field to determine the conditional search for the alert.

View solution in original post

0 Karma

tkwaller
Builder

Nevermind, changed the base search, added a new field for eval and used that field to determine the conditional search for the alert.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...