My requirement is to get the rate of change of a certain parameter if its corresponding alert gets triggered.
To add more details, we have a log file that logs the backlog of database. Once the backlog crosses a certain threshold we trigger an alert, however it could be a false positive since the system may be undergoing maintenance and hence backlog grows.
So I want the alert to trigger another query that captures rate of growth over the last 'x' hours.
This will give more context about what is happening in the system.
How to achieve this in splunk? Please share your ideas
