Dashboards & Visualizations

How to set alert search when more than 10 API calls Noderesponse-time is beyond threshold(5000ms)

aditsss
Builder

Hi Everyone,

I need to set one alert when more than  10 API calls Noderesponse-time is beyond threshold(5000ms)

Below is my search:

index=abc ns=gateway (nodeUrl ="*") Trace_Id=* "*" | stats count by Trace_Id Span_Id ns app_name Log_Time caller nodeUrl nodeHttpStatus nodeResponseTime |rename caller as "Caller"|rename nodeUrl as "Node" |rename nodeHttpStatus as "NodeHttpStatus"|rename nodeResponseTime as "NodeResponseTime"| fields - count|replace "https://datagraphaccountnode/graphql" with "Account" |where NodeResponseTime >5000

Can someone guide me how to set the condition for more then 10 API calls in search.

That means when more then 10 NodeResponseTime should be greater then  5000ms.

Can someone guide me how to set that condition.

Thanks in advance

Labels (3)
0 Karma

scelikok
Champion

Hi @aditsss,

Please try by adding below to the end of your search;

| stats count
| where count > 10
If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!