What is the process for setting up an alert to trigger for >15 events in a 30 minute time?

[CaptainHook]

Hello fellow Splunkers...I am currently work on a search that I need to alert on if it occurs greater than 15 times in a 30 minute period. I have set up the search/alerting, but I am a little lost on the best way to have the criteria inputted. Also, would it be best to set up a stats count, rather than using the alerts GUI? Any assistance would be appreciated.

Thank you.

[yannK · Accepted solution]

try a search like :

<mysearchterms> | bucket _time span=30m | stats count by _time | where count > 15

it will return event count in 30 min bucket time, only if this count is higher than 15

the schedule to run on at least 30 minutes timerange

and put an alert trigger condition on : results > 0

[CaptainHook]

Thank you, that is exactly what I was hoping to find. Much appreciated.

[sloshburch]

Elaboration: Check the timechart command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart which means you can do:
<mysearchterms>
| timechart span=30min count
| where count > 15

Selfish Plug: Also, since you mentioned 15 times per 30min, I can't help but suggest my blog post on the topic: http://blogs.splunk.com/2016/01/29/writing-actionable-alerts/ In that post, I elaborate on how to have more adaptive thresholds rather than static.

[CaptainHook]

Excellent! Thanks Burch, that is a great help.