I need to generate an alert when the count of errors are greater than 10 in one hour. This is easy, but now, I need to do an evolution time chart with the alerts that have occurred. With the data of last one month, I had thought make a timechart with span=1h, but this really does not give the wanted result (because, for example, if we have 5 errors between 12:00 and 13:00, and 7 errors between 13:00 and 14:00 it does not showing error, but it can be error if the 12 errors would be within period of 60 minutes).
We have same trouble with transaction. If I make a transaction establishing a maxspan of 1h, Splunk would detects the first error event and would search error events for next hour, making that if there are 5 errors in the first time period, and 7 in the next period, it does not recognizing it like there was more than 10 errors in a period of 60 mins. We have tried to use maxevents in transaction instead of maxspan and making a eval the duration of the transaction, but in this case Splunk would make bundles of 10 events, because of this neither is valid to our needed.