How to create a (where) Alert parameter

[albyva]

I'm using (where) to alert me if a field exceeds 80% but what I also need is to prevent it from
alerting if that field exceeds 100%. Here is what I have now:

| where bandwidth > 80

How can this be adjusted to be greater than 80, but less than 100?

Thanks,

[kristian_kolb · Accepted solution]

As you can see in the documentation for where, that is just a simple AND;

<your_search> | where bandwidth > 80 AND bandwidth < 100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

/K

[albyva]

Great. Thanks. Guess I missed that one. 🙂