Hi Team, We are using Alert manager enterprise to receive the alert notifications. As we are new to this alert manager enterprise, we would like to understand few features about it. Firstly, we have use cases with threshold criteria.  So, we would like to understand that if we have events which are with inside the threshold limit but not with exact threshold match (i.e) we set an alert to trigger if we encounter 5 failure attempts for any user within 5minutes. But in real time, we noticed that 5 failure attempts for user within 2 minutes, as we set up threshold as 5 minutes, even though we have 5 failure attempts within  2 minutes, will it trigger an alert? 

Hi,  we implemented persistent queues to catch high latencies between the locations.  E.g. Connection is down for some minutes / hours and the firewall is not buffering logs itself so it gets lost if queues are filled up..  Is there a way to monitor the persistent queues? Fill ration or other metrics?    I dont want to build custom scripts collecting bash information.  

共有ディスクを利用したクラスタ構成のサーバで共有ディスク上のログをuniversal forwarderでSplunkCloudへ転送しアラートにより特定条件のメッセージ監視をしようとしています。 通常運用時は問題ありませんが、クラスタでフェールオーバーが発生した場合に待機系サーバのuniversal forwarderでは共有ディスク上のログを先頭から読み込んでしまい、SplunkCloud上ではログの重複が発生してしまいます。 このような共有ディスク構成でのクラスタ構成においてフェールオーバー後に転送対象ログを先頭から転送しないなどSplunkCloud上でログが重複しないような工夫をされた方はいらっしゃいませんでしょうか。 I am trying to forward the logs on the shared disk to Splunk Cloud using a universal forwarder on a server in a cluster configuration using a shared disk, and use alerts to monitor messages under specific conditions. There is no problem during normal operation, but if a failover occurs in the cluster, the universal forwarder on the standby server will read the logs on the shared disk from the beginning, resulting in duplicate logs on Splunk Cloud. In a cluster configuration with a shared disk configuration like this, has anyone taken any measures to prevent logs from being duplicated on SplunkCloud, such as not transferring logs to be transferred from the beginning after a failover? *Translated by the Splunk Community Team*

Want to add a text box on a dashboard  e.g--> search |table field1 field2 field3 Here I want to put a textbox on field3 on the pannel it self so that it can be filter with the field3 value.