Why is Splunk not allowing me to specify the trigger condition "Threads > 1600" for my custom alert?

[B83896]

Hi,

I am using the following search for monitoring number of Threads on a server:

index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date

and I want to set up an alert to be triggered when conditions are met (custom alert): Threads > 1600. But Splunk does not allow me to specify this condition in the alert "threads > 1600".

Could you please help me in resolving this? Thanks,

[renjith_nair · Accepted solution]

Try providing the condition as search Threads > 1600 in the condition box.
Another way to do is including the condition in the search itself and alert when Number of Resultsis greater than '0'

ie

index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date|search Threads > 1600

and then selecting the drop down Number of Results is greater than 0

[B83896]

Hello,
Great! Thanks - first option worked for me!

[renjith_nair]

Good to know. Please accept as answer so that the thread will be closed

[B83896]

Done, thank you!