Hi Manjumanth, below is the saved search configuration for this alert
[DOIT(1m)-JBOSS 7 OutOfMemory]
action.email = 1
action.email.include.trigger = 1
action.email.include.view_link = 0
action.email.inline = 1
action.email.priority = 1
action.email.sendresults = 1
action.email.subject.alert = OutOfMemory Splunk Alert: $name$
action.email.to = test@ekp.org
action.email.useNSSubject = 1
action.logger = 1
alert.digest_mode = 0
alert.suppress = 1
alert.suppress.fields = host
alert.suppress.period = 60s
alert.track = 0
counttype = number of events
cron_schedule = /1 * * * *
description = Alert is triggered when there is an OutOfMemory error in one of the JVMs. Tags(JB7INT, JB7QA, JB7PROD).\
\
Requested by Web Support
dispatch.earliest_time = -1m@m
dispatch.latest_time = @m
display.events.fields = ["source","sourcetype","context_root","referer_domain","status","host","loglevel","field4","ProcessingTime","METHOD","PROTOCOL","REMOTE_HOST","RESPONSE_TIME","STATUS","SIZE","URI","X_FORWARDED_IP","REFERER"]
display.events.maxLines = 0
display.general.enablePreview = 0
display.page.search.mode = verbose
display.statistics.drilldown = row
display.statistics.rowNumbers = 1
display.visualizations.charting.chart = line
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=i_ ("tag::host"=JB7INT OR "tag::host"=JB7QA OR "tag::host"=JB7PROD) OutOfMemory NOT HeapDumpOnOutOfMemoryError
... View more