Hi,
I'm looking for a way to raise an alert in Splunk when the number of errors for a given event exceeds a set threshold within a set period of time - for example >10 events in a 5 minute period (alert raised). It must only be raised once.
I then want another alert to be raised when that previous alert no longer applies (alert over) - for example there are now 0 events in a 5 minute period. This also must only be raised once.
If, subsequently, the first alert is triggered again, then it will alert and so on, toggling between alert raised and alert over.
Any help would be much appreciated as I can't find any info on how I might go about this.
Thanks in advance.
Phil Hamer
