Alerting

Addcoltotals as threshold alert

Explorer

Hi Fellow Splunkers,

I have a search which sums up the total numerical values of the columns so basically i use addcoltotals function.

My question is what will be my conditional search to my alerts creation? Because my threshold is depends on the total of my columns using addcoltotals. Since addcoltotals is not a field in my results. Thanks...

Path Finder

Try Something like below:

stats count by something| addcoltotals labelfield=something label=Total | eval check=if(count>200, 1, 0) | search check=1

Alert on check=1 or 0 based on your threshold as check would be a field.

0 Karma

SplunkTrust
SplunkTrust

Add an stats command at the end of your search to get the max value of the column and alert based on its value.