Log correlation and alerts

[hveillette]

Hi,

I'm looking to know if the following is supported Out of the box, or if it is achievable on Splunk platform.

My client want's the monitoring system to send an alert only when there is more than 9 messages with the level "WARN" for the service "A" within a given interval of time. The system should make such evaluation each time a log with the level "WARN" for service "A" if fired.

Regards,

[BobM]

Yes that's a standard alert setting and you can have it alert with Seperated counts for each service.
See http://docs.splunk.com/Documentation/Splunk/5.0.1/Alert/Alertexamples