Dashboards & Visualizations

How to set alert search when more than 10 API calls Noderesponse-time is beyond threshold(5000ms)

aditsss
Motivator

Hi Everyone,

I need to set one alert when more than  10 API calls Noderesponse-time is beyond threshold(5000ms)

Below is my search:

index=abc ns=gateway (nodeUrl ="*") Trace_Id=* "*" | stats count by Trace_Id Span_Id ns app_name Log_Time caller nodeUrl nodeHttpStatus nodeResponseTime |rename caller as "Caller"|rename nodeUrl as "Node" |rename nodeHttpStatus as "NodeHttpStatus"|rename nodeResponseTime as "NodeResponseTime"| fields - count|replace "https://datagraphaccountnode/graphql" with "Account" |where NodeResponseTime >5000

Can someone guide me how to set the condition for more then 10 API calls in search.

That means when more then 10 NodeResponseTime should be greater then  5000ms.

Can someone guide me how to set that condition.

Thanks in advance

Labels (3)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @aditsss,

Please try by adding below to the end of your search;

| stats count
| where count > 10
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...