Alert when there is more than expected errors in a specific log file?

New Member

I have a log file for a system logging everything in it, that log file has errors in a daily base. I want to make an analysis per hour during business hours, so looking for previous logs and getting the average numbers (count) for each hour. So if in the future that log file has more error than it has before, during a specific time, so thus I need to get alerted on that?
Specific time I mean runnung a query each 15 minutes during business hours, if the errors are more than expected, it means something happens and needs my consideration.

0 Karma


Please post some sample data.

Otherwise, first find your baseline threshold count:

base search for only error events
| timechart count span=15m

Then, write an alert using that threshold.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...