If I wanted to add a "custom" trigger condition to an alert that would trigger the alert only if the search results increase by x percent over 1 hour. How would I go about doing this?
hello there,
will recommend to create a full search that will capture your condition and alert only on "true" or "false" instead of writing the condition in the custom trigger alert. many answers and examples in this portal, here are links to some: https://answers.splunk.com/answers/226668/alert-when-there-is-a-x-increase-in-all-events-dur.html https://answers.splunk.com/answers/8156/rapid-growth-of-values-then-alerting-on-it.html https://answers.splunk.com/answers/526032/calculate-percentage-increasedecrease-of-indexing.html
hope it helps
View solution in original post
