Alerting

How to create an alert based on the threshold condition?

navd
New Member

search query is:

index="confiacd" | stats avg(responsetime)

Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.

0 Karma
1 Solution

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

View solution in original post

0 Karma

s-Lope678
Observer

What does your "500" threshold mean here? 

0 Karma

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...