Alert when there is more than expected errors in a specific log file?

New Member

I have a log file for a system logging everything in it, that log file has errors in a daily base. I want to make an analysis per hour during business hours, so looking for previous logs and getting the average numbers (count) for each hour. So if in the future that log file has more error than it has before, during a specific time, so thus I need to get alerted on that?
Specific time I mean runnung a query each 15 minutes during business hours, if the errors are more than expected, it means something happens and needs my consideration.

0 Karma


Please post some sample data.

Otherwise, first find your baseline threshold count:

base search for only error events
| timechart count span=15m

Then, write an alert using that threshold.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...