Alerting
Highlighted

How to create an alert if a value of a field is > some value x for 90% of events during a time period

Engager

Newbie to splunk. Could someone help me here. I have events coming in ( lets say 1/sec ) which give me number of connections in use in a pool. I would like to create an alert if say 90% of the events over a 5 minute period exceed some value ( say 10 ).

Any help would be greatly appreciated.

Tags (1)
Highlighted

Re: How to create an alert if a value of a field is > some value x for 90% of events during a time period

SplunkTrust
SplunkTrust

Try something like this (assuming Field name to validate is NoOfConn and threshold NoOfConn is 10)

   ... your search... | eval status=if(NoOfConn > 10,"Over","NA") | eventstats count(eval(status="Over")) as countOver, count as Total | eval overPerc=round((countOver*100/Total)) | where overPerc>=90

View solution in original post

Highlighted

Re: How to create an alert if a value of a field is > some value x for 90% of events during a time period

Engager

Worked great ! Thanks

0 Karma
Highlighted

Re: How to create an alert if a value of a field is > some value x for 90% of events during a time period

SplunkTrust
SplunkTrust

Great. If there are no followup questions, please mark the answer as accepted.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.