Alerting

Help in setting alert

Builder

Hello,

I am setting an alert based on the count i.e if the count is greater than 50 then we need to generate an alert.

I wrote the query and saved as alert

alert type=Real time
Trigger Condition=Custom
Custom Condition= search count>50
time: in 5 mins
and then selected the e-mail as triggered condition

in Throttle what should I give such that the alert when generated in 5 minutes should set the time back to zero before generating another alert

Tags (4)
0 Karma

Splunk Employee
Splunk Employee

If your search is scheduled to run every five minutes (is it, actually?), then set the throttling to suppress the alert to something greater than five minutes.

0 Karma

Builder

its not every 5 minutes,it will alert if the count is greater than 50 in a 5 mins window

0 Karma

Splunk Employee
Splunk Employee

So what is the schedule you have set for the search itself?

0 Karma

Builder

all time for search,the alert is customized

search count>50

is the syntax correct for the alert or should it be in double quotes

0 Karma

Splunk Employee
Splunk Employee

Hi @vrmandadi,
I think it might be helpful to reconsider the alerting behavior you would like to have. When you say, "set the time back to zero" in your original question, it makes me think that you might want a scheduled alert that runs a search every five minutes to check for more than 50 events. If there are more than 50 results for that search, you get an email notification. Does that sound more like the outcome you are trying to set up? Let me know either way and I can suggest some resources.

As a start, this comparison chart might help.
http://docs.splunk.com/Documentation/Splunk/6.4.0/Alert/AlertTypesOverview