Alerting

Search Query - Alert

rashi83
Path Finder

Hi ,
I have a query which returns 5 events ( basically 5 files gets transferred) . I need to send an alert once all 5 files are transferred - meaning as soon as the event count is 5 , alert should be triggered. IS the below query good enough for such scneario ?

Should I write like index=* X y | stats count by FileName | where count=5

Labels (1)
Tags (2)
0 Karma

to4kawa
Ultra Champion

Does only success populate the event?

0 Karma

rashi83
Path Finder

yes , if only success / transfer happen - event gets written

0 Karma

to4kawa
Ultra Champion

well, your query is enough for this, I think.

0 Karma

rashi83
Path Finder

So while setting up Alert - should I mention Trigger Alert when Number of Results is greater than 4. OR will the query takes care of it.

I am little confused .

0 Karma

to4kawa
Ultra Champion

you use | where count=5
, so to fire
alert

event count > 0

rashi83
Path Finder

Thank you

0 Karma

to4kawa
Ultra Champion

please provide your query for answer and accept it.

0 Karma

rashi83
Path Finder

up voted your answer

0 Karma

to4kawa
Ultra Champion

thank you rashi83

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...