Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to edit my search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
earliest=-48h@h latest=-24h@h index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec"| where instance="User Errors" | stats avg(Value) as PrevErrors | appendcols [ search earliest="-24h@h" latest="@h" index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec" instance="User Errors" | stats avg(Value) as CurrErrors ]| eval PrevErrors=if(isnull(PrevErrors), 0, PrevErrors) | eval CurrErrors=if(isnull(CurrErrors), 0, CurrErrors) | eval CurrErrors=round(CurrErrors,3) |eval PrevErrors=round(PrevErrors,3) |eval CurrErrors=(CurrErrors + " Errors/sec") | eval PrevErrors=(PrevErrors + " Errors/sec") | appendcols [search earliest="-48h" latest="@h" index="my-live-srv" sourcetype="sql-trace" |where Date!="*$" | eval time_marker = if (_time < relative_time(now(), "-24h"), "yesterday", "today")| eval _time = if (time_marker=="yesterday", _time + 24*60*60, _time) ]| streamstats current=f window=1 global=f last(PrevErrors) as PrevErrors | streamstats current=f window=1 global=f last(CurrErrors) as CurrErrors|table CurrErrors,PrevErrors,time_marker,Date,Time, ID, HostName, ClientProcessID, ApplicationName, LoginName, SPID, Severity, EventClass, State, Error, DatabaseName, EventSequence
I want to save this as an alert but I want the alert to trigger only when CurrErrors >1. How can I do this ? I have tried with where condition but I dont have the expected result
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got the issue. You're adding string text to CurrErrors making it a string and your where clause fails. Try adding this to your original search
...| where tonumber(replace(CurrErrors,"^(\d+)\s.+","\1"))>1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got the issue. You're adding string text to CurrErrors making it a string and your where clause fails. Try adding this to your original search
...| where tonumber(replace(CurrErrors,"^(\d+)\s.+","\1"))>1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Now you can Accept!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried now but no result again
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| where CurrErrors < "1"
I needed to enter this in the end of the search
I found the solution, thank you for the help that CurrErrors was a string. This helped me a lot
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Be sure to click Accept to close the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
cant accept, the answer is as a comment
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How about you add | where CurrErrors>1 in your search (at the end) itself and set the alert condition to where number of results is greater than 0?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
nope that doesn't work. I have tried
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
