Splunk Search

How to create a (where) Alert parameter

Communicator

I'm using (where) to alert me if a field exceeds 80% but what I also need is to prevent it from
alerting if that field exceeds 100%. Here is what I have now:

| where bandwidth > 80

How can this be adjusted to be greater than 80, but less than 100?

Thanks,

Tags (1)
0 Karma
1 Solution

Ultra Champion

As you can see in the documentation for where, that is just a simple AND;

<your_search> | where bandwidth > 80 AND bandwidth < 100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

/K

View solution in original post

Ultra Champion

As you can see in the documentation for where, that is just a simple AND;

<your_search> | where bandwidth > 80 AND bandwidth < 100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

/K

View solution in original post

Communicator

Great. Thanks. Guess I missed that one. 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!