How to raise alert when threshold exceeded and alert when condition abates?



I'm looking for a way to raise an alert in Splunk when the number of errors for a given event exceeds a set threshold within a set period of time - for example >10 events in a 5 minute period (alert raised). It must only be raised once.

I then want another alert to be raised when that previous alert no longer applies (alert over) - for example there are now 0 events in a 5 minute period. This also must only be raised once.

If, subsequently, the first alert is triggered again, then it will alert and so on, toggling between alert raised and alert over.

Any help would be much appreciated as I can't find any info on how I might go about this.

Thanks in advance.

Phil Hamer

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...