Why is my savedsearches.conf configuration not honoring the alert condition of number of events > 10?

[shreyasathavale]

I am creating an alert and configuring it in savedsearches.conf. The condition that i am giving is not firing the alert. It is firing whenever it finds the message, but my condition is "it should alert only if it is greater than 10" .. Below is savedsearch

counttype = number of events
quantity = 10
relation = greater than
alert_condition = | Where Message ="asdad"

My alert should fire if I have events more than 10, but even if the events are just 2 it is firing.. Any help?
I have removed alert_condition part now and checking if it works or not.

[somesoni2 · Accepted solution]

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.