Addcoltotals as threshold alert

[leordimalanta]

Hi Fellow Splunkers,

I have a search which sums up the total numerical values of the columns so basically i use addcoltotals function.

My question is what will be my conditional search to my alerts creation? Because my threshold is depends on the total of my columns using addcoltotals. Since addcoltotals is not a field in my results. Thanks...

[isha_rastogi]

Try Something like below:

stats count by something| addcoltotals labelfield=something label=Total | eval check=if(count>200, 1, 0) | search check=1

Alert on check=1 or 0 based on your threshold as check would be a field.

[somesoni2]

Add an stats command at the end of your search to get the max value of the column and alert based on its value.