Alerting

Creating an alert

amirarsalan
Explorer

Hi! Need some help with an alert. I just created an alert. Look at the attached pic. I want it to look today's results and based on my limit send an alert. Right now it check 24 hours back each 5 minutes. But I want it to check today's result and based on that send an alert. Then i wondering if i can make anything to send an update when the alert is solved.

Can someone assist plz alt text

Tags (2)
0 Karma
1 Solution

gfreitas
Builder

Use on the Earliest: @d and for latest use: now
That is the equivalent to today

View solution in original post

gfreitas
Builder

Use on the Earliest: @d and for latest use: now
That is the equivalent to today

gcusello
SplunkTrust
SplunkTrust

Hi @amirarsalan,
could you share your search?
because with the interface you inserted in the question you manage the execution of the check, but the conditions to check are in the main search not here.

Ciao.
Giuseppe

amirarsalan
Explorer

index =xxxxx account_id event_name = "xxxxxx" brand = "xxxxx"
| lookup currency_eur currency AS currency OUTPUT currency_to_eur AS currency_to_eur

| eval xxxxx = coalesce((bonus_amount + amount),0)
| eval xxxxx_EUR = IF(market = "DK", (Bonus_Amt*0.134), Bonus_Amt*currency_to_eur)
| bin _time span=15m
| eval Hour = STRFTIME(_time, "%H:%M")
| eval Day = STRFTIME(_time,"%Y-%m-%d")
| eval where_clause = IF("GB" = "-All-", "%%", "GB")
| where market LIKE where_clause
| stats SUM(Bonus_Released_EUR) AS "TOTALR"
| search TOTALR>16500

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...