All Apps and Add-ons

Creating threshold alerts.

paul_1994
Path Finder

I had a request to provide the alert below and I am trying to figure out the best way to tackle it.

run this query every 5 minutes and response time >2000 for more than 10 occurrences then raise email to below group also if possible please plot the timechart with this query

index=xxx_logs service_name=cix* operation=GetTypeFrom* Transaction_time>2000  | timechart max(Transaction_time) by operation

Thanks in Advance!

Update:

I created an alert to run every 5min and to alert if threshold reaches over 10 occurrences.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Hi, the query below would give you a table of operations that have exceeded 2000 (ms?) more than 9 times for the time period searched. I'm not exactly sure that that's what you're asking for, but I think so.

index=xxx_logs service_name=cix* operation=GetTypeFrom* Transaction_Time > 2000 |stats c by operation | where c>9

If you want to make a chart of that, you could replace the stats with a timechart span=5min

Hope this helps,

K

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...