Custom Trigger Condition (Percent increase)

[summitsplunk]

If I wanted to add a "custom" trigger condition to an alert that would trigger the alert only if the search results increase by x percent over 1 hour. How would I go about doing this?

[adonio · Accepted solution]

hello there,

will recommend to create a full search that will capture your condition and alert only on "true" or "false" instead of writing the condition in the custom trigger alert.
many answers and examples in this portal, here are links to some:
https://answers.splunk.com/answers/226668/alert-when-there-is-a-x-increase-in-all-events-dur.html
https://answers.splunk.com/answers/8156/rapid-growth-of-values-then-alerting-on-it.html
https://answers.splunk.com/answers/526032/calculate-percentage-increasedecrease-of-indexing.html

hope it helps