Here are some details about how the different parts of an alert work together.
Search: What do you want to track?
Start with a search for the events you want to track. Save the search as an alert.
Alert type: How often do you want to check for events?
The alert uses the saved search to check for events. Adjust the alert type to configure how often the search runs. Use a scheduled alert to check for events on a regular basis. You can also use a real-time alert to monitor for events continuously.
Alert trigger conditions and throttling: How often do you want to trigger an alert?
An alert does not have to trigger every time it generates search results. Set trigger conditions to manage when the alert triggers. You can also throttle an alert to control how soon the next alert can trigger after an initial alert.
Alert Action: What happens when the alert triggers?
When an alert triggers, it can initialize one or more alert actions. An alert action can notify you of a triggered alert and help you start responding to it. You can configure alert action frequency and type.
In short , start from https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/AlertWorkflowOverview
Here are some examples : https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Alertexamples
Happy Splunking!
