Alerting

Sending alert based on Threshold conditions

sajug
New Member

Hello
I have query that gets me x values every 5 minutes. Now what I am trying to achieve is, alert based on threshold conditions. For example

index=xxx | timechart span=5m eval(round(avg(x),3)) as xvalues

Condition for alerting below

xvalues<100 no alert
xvalues>100 and <200 - Warning alert
xvalues>200 Critical

Thanks in advance

0 Karma

sajug
New Member

Oops I was not aware the editor does not support certain symbols. So here are the alerting conditions again

xvalues<=100 no alerting
xvalues>100 and <=200 warning
xvalues>200 - Critical Alert

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...