Archive
Highlighted

Customer trigger for alerts

Explorer

I'm looking for a way to setup a customer trigger for the below search. Basically I need the alert to go off if RespCode=60 is greater than 3%. When I try entering percentage as the Customer trigger Splunk says "In handler 'savedsearch': Cannot parse alert condition. Unknown search command 'percentage'." I uploaded a pic of the results if that helps.

index=main sourcetype=ivr host=apcv* card_validation response=* | stats count by RespCode | eventstats sum(count) as TotalofAllRespCodes | eval percentage=(count/TotalofAllRespCodes*100) | search RespCode=60

alt text

0 Karma
Highlighted

Re: Customer trigger for alerts

SplunkTrust
SplunkTrust

What condition are you alerting on exactly? What is the alert criteria?

Highlighted

Re: Customer trigger for alerts

Explorer

I want the alert to trigger if RespCode of 60 is greater than 3%.

0 Karma
Highlighted

Re: Customer trigger for alerts

Contributor

Based on the table you provided, you could add a |where percentage > 3 at the end of your search.

View solution in original post

Highlighted

Re: Customer trigger for alerts

Explorer

Thanks. I do believe that will do it. I was over complicating things apparently.

0 Karma