Newbie to splunk. Could someone help me here. I have events coming in ( lets say 1/sec ) which give me number of connections in use in a pool. I would like to create an alert if say 90% of the events over a 5 minute period exceed some value ( say 10 ).
Any help would be greatly appreciated.
Try something like this (assuming Field name to validate is NoOfConn and threshold NoOfConn is 10)
... your search... | eval status=if(NoOfConn > 10,"Over","NA") | eventstats count(eval(status="Over")) as countOver, count as Total | eval overPerc=round((countOver*100/Total)) | where overPerc>=90
Great. If there are no followup questions, please mark the answer as accepted.