Alerting

How to create a custom alert when count of responseStatus>20?

vijaysubramania
Path Finder

My custom alert is triggering mails for zero events. Not sure why it's printing for 0 when responseStatus > 399

I have created the alert with condition responseStatus 499>20 ..Trigger an email. But it's printing zero record as well for every minute and triggering mail. Is it because of running the query in timechart instead of  using stats count or we should not create with stats count

(responseStatus>399)| dedup requestId | stats count by responseStatus

How to set custom alert for this? 

vijaysubramania_0-1596734296188.png

 

vijaysubramania_1-1596734317628.png

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Please share your search.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...