Alerting

Creating an alert

amirarsalan
Explorer

Hi! Need some help with an alert. I just created an alert. Look at the attached pic. I want it to look today's results and based on my limit send an alert. Right now it check 24 hours back each 5 minutes. But I want it to check today's result and based on that send an alert. Then i wondering if i can make anything to send an update when the alert is solved.

Can someone assist plz alt text

Tags (2)
0 Karma
1 Solution

gfreitas
Builder

Use on the Earliest: @d and for latest use: now
That is the equivalent to today

View solution in original post

gfreitas
Builder

Use on the Earliest: @d and for latest use: now
That is the equivalent to today

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @amirarsalan,
could you share your search?
because with the interface you inserted in the question you manage the execution of the check, but the conditions to check are in the main search not here.

Ciao.
Giuseppe

amirarsalan
Explorer

index =xxxxx account_id event_name = "xxxxxx" brand = "xxxxx"
| lookup currency_eur currency AS currency OUTPUT currency_to_eur AS currency_to_eur

| eval xxxxx = coalesce((bonus_amount + amount),0)
| eval xxxxx_EUR = IF(market = "DK", (Bonus_Amt*0.134), Bonus_Amt*currency_to_eur)
| bin _time span=15m
| eval Hour = STRFTIME(_time, "%H:%M")
| eval Day = STRFTIME(_time,"%Y-%m-%d")
| eval where_clause = IF("GB" = "-All-", "%%", "GB")
| where market LIKE where_clause
| stats SUM(Bonus_Released_EUR) AS "TOTALR"
| search TOTALR>16500

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!