Splunk Alert Setup

[csridhar]

Hello Everyone,

I need a help in setting up Splunk Alert to generate an alert if we get 60 errors per minute over a 5 minute period

[richgalloway]

Perhaps this will get you started.

index=foo earliest=-5m ERROR
```Group events by the minute```
| bin span=1m _time
```Count how many occurred each minute```
| stats count by _time
```Keep only the minutes where the count was 60
| where count=60
```Count how many minutes are represented```
| stats count
```Return results if all 5 minutes have 60 errors```
| where count=5