I am a newbie on Splunk and have been trying to create an alert using the following search:
index=prodenvs source=prodlogs "transaction timeout"
I had setup it to cron every 5 mins and check past 5 mins and alert if the count goes more than 10. The alert was working fine but I wanted to summarize the results based on hosts.
index=prodenvs source=prodlogs "transaction timeout" | chart count by host
The alert stopped working after I changed it and I noticed that the alert criteria is taking number of hosts as the "count" now. Can I still use the alert feature based on the number of events and yet be able to chart my results? Any help is greatly appreciated.