Need Help on alerts

Path Finder


I have created an alert which checks the transaction's response time, if the response time is more than 10 mins splunk will send an email alert

Here is the search query:

sourcetype="access_log" host=hostname*
| eval headers=split(_raw," ")
| eval username=mvindex(headers,2)
| eval method=mvindex(headers,5)
| eval Request=mvindex(headers,6)
| eval Status=mvindex(headers,8)
| eval Payload=mvindex(headers,9)
| eval req_time=mvindex(headers,10)
| eval uri=mvindex(headers,11)
| eval Method=replace(method,"\"","")
| eval uri=replace(uri,"\"","")
| eval RequestTime_Minutes = req_time*0.0000166667
| eval Response_Time_in_Minutes= round(RequestTime_Minutes,2) | table Response_Time_in_Minutes host username _time uri Request Status
| search Response_Time_in_Minutes > 10


My Question:

I want to exclude 1 particular transaction:


I do not want the alerts if its the above mentioned transaction since it doesn't affect our app in any way, how do i go about it?


Labels (3)
0 Karma
1 Solution


Try adding 

AND NOT "searchrequest-excel-all-fields"

to your final search

View solution in original post


Try adding 

AND NOT "searchrequest-excel-all-fields"

to your final search

Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...