Alert radius accountig request per second

New Member

Hi all

I need help to configure alert for radius accounting request per second. To find requests per second we did this formula:

sourcetype="cisco:bulkstats:up:systemSch10" host=dyu-sae-1-1
| stats sum(aaa_ttlradacctreq) as req sum(aaa_ttlradacctreqretried) as retr by _time
| delta req as rq
| delta retr as rt
| timechart span=5m per_second(rq) as "requests per second" per_second(rt) as "retries per second"

per_second(rq) shows approximately 400 request/s

So I want to configure alert if this goes to 600 request/s 

Any help appreciated


Many thanks

Labels (2)
0 Karma



Splunk provides a manual dedicated to alerting: Alerting Manual.

From Create scheduled alerts:

  1. Navigate to the Search page in the Search and Reporting app.
  2. Create a search.
  3. Select Save As>Alert.

From Configure alert trigger conditions:

Use a search with custom trigger condition

The alert uses this search, with Last 7 days selected in the time range picker.


index=_internal (log_level=ERROR OR log_level=FATAL OR log_level=CRITICAL) | stats count by log_level


The following custom triggering condition is added.


search count > 10


In this scenario, the original search results detail the count for all log levels, but the alert triggers only when the log_level counts are greater than ten. This means that all log_level counts are available to use as part of an alert notification.

In your custom trigger condition, enter e.g.:


search "requests per second" >= 600


You can also add a where or search command to the base alert search and trigger the alert when Number of Results is greater than: 0

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>