Customer trigger for alerts

[jephillips]

I'm looking for a way to setup a customer trigger for the below search. Basically I need the alert to go off if RespCode=60 is greater than 3%. When I try entering percentage as the Customer trigger Splunk says "In handler 'savedsearch': Cannot parse alert condition. Unknown search command 'percentage'." I uploaded a pic of the results if that helps.

index=main sourcetype=ivr host=apcv* card_validation response=* | stats count by RespCode | eventstats sum(count) as TotalofAllRespCodes | eval percentage=(count/TotalofAllRespCodes*100) | search RespCode=60

[adayton20 · Accepted solution]

Based on the table you provided, you could add a |where percentage > 3 at the end of your search.

[jephillips]

Thanks. I do believe that will do it. I was over complicating things apparently.

[burwell]

What condition are you alerting on exactly? What is the alert criteria?

[jephillips]

I want the alert to trigger if RespCode of 60 is greater than 3%.