I believe I got the same error message, yes. As mentioned, the other issue with my search was that I put in a charting section when saving it as an alert. It seemed my search would only work for either the alert clause or charting clause, whatever came first in my search, but wouldn't do both. Thanks again for the help 🙂 ... View more

Thanks again for your help, I finally got things working. Thanks to your response, I added "| stats count(eval(y-axis-param <= 2)) as failcount" at the end of my search, then in trigger condition said "search failcount > 0". Before, I didn't have search in there. Another change I had to make was that in the search, I included both the mentioned stats condition AND the condition for charting things - "| timechart (y-axis-param)". Whether or not this should be the case, I realized that things wouldn't work if I did both at the same time, just whatever was first in the search would be executed. So I removed the charting condition from the search" and just kept the stats condition, then the alerts started working. Thanks so much! ... View more

Apologies if I'm repeating this response, but after typing in the "Post Your Answer To This Question" field and submitting, I don't see what I typed anywhere, so I'm doing it again just in case: Thanks so much for the response. Unfortunately, the trigger condition isn't recognizing the variable I defined. I followed the syntax of your suggestion and tried a couple modifications to no end - I think the problem now lies elsewhere. My assumption is that because we are parsing log data for a specific value to generate our y-axis, and our Splunk search is pretty cryptic (mostly regex), we aren't defining this value clearly enough in our search to be assigned to a variable that we can then use in a trigger condition. I will see if there is a better way to write our search so the variable assignment / trigger condition variable will work. Any more insight you may have on this issue would be greatly valued. Thanks so much 🙂 ... View more