Alerting

How to create an alert if count is greater than or less than a particular number?

vrmandadi
Builder

I am trying to create an alert based on stats count value...I want to alert if count is less than or greater than 500

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

greater than or less than a particular number is the same as being not equal to that number. Is that what you want your alert triggered on?

0 Karma

vrmandadi
Builder

Yep.That is correct..So just use count!=500 ...is that the only thing needed

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes - you'll probably need a custom action and the result you are comparing must be in the first row of the search results

0 Karma

vrmandadi
Builder

Got it Thanks

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you're only interested in count, you can simply formulate your search so that it does the stats count part but if it's different than 500 returns no results. Then you would simply alert whenever you got any result from your search.

But of course if you're interested in detailed view of those 500 events it won't work.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...