Hi
I have created an alert which checks the transaction's response time, if the response time is more than 10 mins splunk will send an email alert
Here is the search query:
sourcetype="access_log" host=hostname*
| eval headers=split(_raw," ")
| eval username=mvindex(headers,2)
| eval method=mvindex(headers,5)
| eval Request=mvindex(headers,6)
| eval Status=mvindex(headers,8)
| eval Payload=mvindex(headers,9)
| eval req_time=mvindex(headers,10)
| eval uri=mvindex(headers,11)
| eval Method=replace(method,"\"","")
| eval uri=replace(uri,"\"","")
| eval RequestTime_Minutes = req_time*0.0000166667
| eval Response_Time_in_Minutes= round(RequestTime_Minutes,2) | table Response_Time_in_Minutes host username _time uri Request Status
| search Response_Time_in_Minutes > 10
My Question:
I want to exclude 1 particular transaction:
"searchrequest-excel-all-fields"
I do not want the alerts if its the above mentioned transaction since it doesn't affect our app in any way, how do i go about it?
