Alert to show if a Users data level goves over 1GB

[DDewarSplunk]

Afternoon Splunk Gurus

I am trying to create an alert, where as if a users data (Bytes_out) goes over 1GB then I get an email.

So far I can list the users as per below but am now struggling to define only data over 1GB and get the alert to send me an email (Like a table) with user name PC Name Etc Etc

Any help would be really appreciated.

Thanks

D

sourcetype="traffic" eventtype="traffic"
| stats sum(bytes_out) by user src_ip app app:subcategory eventtype
| dedup user, src_ip, app, app:subcategory
| rename sum(bytes_out) as sbo
| eval "MegaBytes"=((sbo)/1024)/1024
| fields - sbo
| sort -"MegaBytes"
| sort -total | head 10

[mayurr98 · Accepted solution]

hey @DDewarSplunk

You can define your condition in the query itself and just create an alert

sourcetype="traffic" eventtype="traffic" 
| stats sum(bytes_out) by user src_ip app app:subcategory eventtype
| dedup user, src_ip, app, app:subcategory
| rename sum(bytes_out) as sbo 
| eval "MegaBytes"=((sbo)/1024)/1024 
| fields - sbo
| sort -"MegaBytes" 
| sort -total | where MegaBytes>1024

Let me know if it works!

[DDewarSplunk]

Ahh Thanks....I t I was over thinking \ complicating it !!
Keep it nice and simple is the secret !

Thanks very much Mayurr98