Alerting
Highlighted

Custom alert trigger condition for passing time amount

Communicator

Hi all,

I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's

stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report"

0 Karma
Highlighted

Re: Custom alert trigger condition for passing time amount

Communicator

Answering my own question: This result can be achieved by specifying the number or results as the trigger condition.

View solution in original post

0 Karma
Highlighted

Re: Custom alert trigger condition for passing time amount

SplunkTrust
SplunkTrust

@ryhluc01 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma