Trying to get an alert from Splunk when an average for a specified time and number of documents > 1.
Example taken for this event:
TIME TAKEN : 2.59 second(s) , NO OF DOCS : 3
2.59/3 =.86333 seconds per document
We want to track if the value is 1 second per document.
Once we have that, if the trend is that this value continues to climb over, we want another alert to warn us of a potential memory leak.
Any help appreciated.
Try this:
| rex "TIME TAKEN : (?<seconds>\S+).*NO OF DOCS : (?<documents>\d+)" | eval docsPerSecond = documents/seconds | where docsPerSecond > 1 | timechart span=1h avg(docsPerSecond)
Hi MikeBertelsen
Run the query that Woodcock gave you . Save it as alert by filling the important field