Alerting

How to create an alert based on the threshold condition?

navd
New Member

search query is:

index="confiacd" | stats avg(responsetime)

Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.

0 Karma
1 Solution

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

View solution in original post

0 Karma

s-Lope678
Observer

What does your "500" threshold mean here? 

0 Karma

kmaron
Motivator

Put the condition in the query:

index="confiacd" | stats avg(responsetime)  as average_response | where average_response > 500

Then in your alert definition set your Trigger Condition to Number of Results > 0

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...