How to create an alert if a value of a field is > some value x for 90% of events during a time period

[testSplunk1]

Newbie to splunk. Could someone help me here. I have events coming in ( lets say 1/sec ) which give me number of connections in use in a pool. I would like to create an alert if say 90% of the events over a 5 minute period exceed some value ( say 10 ).

Any help would be greatly appreciated.

[somesoni2 · Accepted solution]

Try something like this (assuming Field name to validate is NoOfConn and threshold NoOfConn is 10)

   ... your search... | eval status=if(NoOfConn > 10,"Over","NA") | eventstats count(eval(status="Over")) as countOver, count as Total | eval overPerc=round((countOver*100/Total)) | where overPerc>=90

[somesoni2]

Great. If there are no followup questions, please mark the answer as accepted.

[testSplunk1]

Worked great ! Thanks