Addcoltotals as threshold alert


Hi Fellow Splunkers,

I have a search which sums up the total numerical values of the columns so basically i use addcoltotals function.

My question is what will be my conditional search to my alerts creation? Because my threshold is depends on the total of my columns using addcoltotals. Since addcoltotals is not a field in my results. Thanks...

Path Finder

Try Something like below:

stats count by something| addcoltotals labelfield=something label=Total | eval check=if(count>200, 1, 0) | search check=1

Alert on check=1 or 0 based on your threshold as check would be a field.

0 Karma

Revered Legend

Add an stats command at the end of your search to get the max value of the column and alert based on its value.

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...