Addcoltotals as threshold alert


Hi Fellow Splunkers,

I have a search which sums up the total numerical values of the columns so basically i use addcoltotals function.

My question is what will be my conditional search to my alerts creation? Because my threshold is depends on the total of my columns using addcoltotals. Since addcoltotals is not a field in my results. Thanks...

Path Finder

Try Something like below:

stats count by something| addcoltotals labelfield=something label=Total | eval check=if(count>200, 1, 0) | search check=1

Alert on check=1 or 0 based on your threshold as check would be a field.

0 Karma

Revered Legend

Add an stats command at the end of your search to get the max value of the column and alert based on its value.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!