Alerting

How to create an alert based on the threshold condition?

navd
New Member

search query is:

index="confiacd" | stats avg(responsetime)

Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.

0 Karma
1 Solution

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

View solution in original post

0 Karma

s-Lope678
Observer

What does your "500" threshold mean here? 

0 Karma

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...