Alerting

How to create an alert based on the threshold condition?

navd
New Member

search query is:

index="confiacd" | stats avg(responsetime)

Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.

0 Karma
1 Solution

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

View solution in original post

0 Karma

s-Lope678
Observer

What does your "500" threshold mean here? 

0 Karma

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...