Unbalanced Load Alert

New Member

I want to be alerted when the motor load on a machine is more than 10 higher or lower than the other motor load (they should usually be balanced and share the load evenly. Unbalanced load could lead to a failure).

Would I essentially need to build two alerts for this? One for alerting when Z is 10 higher than Y, and another for when Z motor is 10 lower than Y? Or can it be done in one?

If ZLoad > (YLoad +10) when [tag]=STOPPED

0 Karma

Revered Legend

You can do both in One. Something like this:

your current search fetching zLoad and YLoad
| eval diff=zLoad-YLoad , eval type=if(diff>0,"Higher","Lower")
| where abs(diff)>=10
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...