Creating an alert when the Value of a counter hit a threshold

[saccam447]

Im trying to create an alert where it will generate an alert when the Value of my search ( source="perfmon:physical disk latency" counter="avg. disk sec/read" host="servername" instance=* ) is greater than 0.25. Does this need to be a basic or advanced condition? Im new to creating alerts.

Can someone point me in the right direction?

Much appreciated.

Scott

[BobM · Accepted solution]

You have two choices both using the where command and depending on what you want your user to see.
If you add it to your search string as below, you would only get an event if it was above 0.25. You can then set it to alert if the number of events is > 0

source="perfmon:physical disk latency" counter="avg. disk sec/read" host="servername" instance=* | where Value>0.25

Or you can leave it out of your search and add it in as a "custom condition" in the alert. The user will then only get an alert if one or more have a Value over 0.25 but will get all events in the results. I would tend to display it as a table and use the timepicker to restrict the time.

source="perfmon:physical disk latency" counter="avg. disk sec/read" host="servername" instance=*| table _time host object instance counter Value

Then click on "Create an Alert", Give it a search name , Share it if required, and click Next.
Change "Condition" to "If custom condition is met" and in the "conditional search string" box type

where Value > 0.25

set the schedule, throttling, Expiration and severity to what you want. Then set it up to send you an email or whatever your preferred alert type is.

You will then get an alert whenever any value is over 0.25 and when you look at the results, you will see all the scans in your time range.

[BobM]

I will update the reply.

[saccam447]

Your first suggestion worked perfectly. Had issues with the second option working correctly. But I am really interested in the second option as well so I don't need to create a separate report to do an alert. would you please elaborate.