Alerting

Sending alert based on Threshold conditions

sajug
New Member

Hello
I have query that gets me x values every 5 minutes. Now what I am trying to achieve is, alert based on threshold conditions. For example

index=xxx | timechart span=5m eval(round(avg(x),3)) as xvalues

Condition for alerting below

xvalues<100 no alert
xvalues>100 and <200 - Warning alert
xvalues>200 Critical

Thanks in advance

0 Karma

sajug
New Member

Oops I was not aware the editor does not support certain symbols. So here are the alerting conditions again

xvalues<=100 no alerting
xvalues>100 and <=200 warning
xvalues>200 - Critical Alert

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...