i want to create a alert on avg disk read/write latency

[DataOrg]

Below is the example for an event. below are the values available.i want to calculate avg value with span 30 secs and and if value crosses continuously 0.30 for more than 5 mins. the alert should trigger. the data will be available every 10 seconds

for time. we have _time

value disk_type counter drive
0.008749994761904096 PhysicalDisk Avg. Disk sec/Read G
0.008377771786948093 PhysicalDisk Avg. Disk sec/Read G:

[inventsekar · Accepted solution]

try..

sourcetype="your source type" search phase | bucket _time span=30s | stats avg(value) as Average by _time | where Average > 0.3

on the alert creation GUI, you can mention, for 5 mins, then send the alert.

[DataOrg]

i want to create alert if the threshold crosses for continuously for 5 mins not on single instance crossing threshold

[inventsekar]

that is what i said, in the alert creation window, you will have option, similar to this..
"Trigger when number of results: is greater than N".

https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Alertexamples

[DataOrg]

if i am having time range for 4 hours. there may be multiple event crossing the threshold but it will not be continuously so how u ill set a condition here to trigger alert?

[inventsekar]

4hrs = 240 mins = 14400 seconds.
14400/30=480

4hrs will be 480 times 30 seconds.
so, if 480 times Avg is above 0.3, trigger an alert.

[DataOrg]

understanding is wrong. consider data between 1Am t0 4AM

if the first instance crossing threshold at 1.05 AM and i want to check other events crossing the continoulsy till 1.10 AM. if in between there is not event crossed the threshold i dont want to create an alert.
and another event crossing threshold at 2.12 AM if continoulsy crossing threshold till 2.17AM i want to trigger alert.

i dont care the event crossing at 2.10 and 3.10 and 3.50 at single instance crossing more than 5 event.

[inventsekar]

ya, i got it...it is possible... currently i am not having access to splunk (alert window)..
you have to adjust that span=30s and the alert trigger time..

you can create a simple alert, for one min, if the avg crossed 0.03, then create an alert..
if it works fine, then you can fine-tune it as per your needs.

(if your query got resolved, can you please accept this as the answer.. you can upvote this answer and comments as well 😉 )

[inventsekar]

Hi Prem.. may we know if this issue got resolved.. are you able to create the alert?!?!
if so, can you please mart this answer as "Accepted Answer", so that this post will move from unanswered to answered.