New to Splunk. Trying to watch an application for abnormal response time behavior and I can't get the alert to trigger. I am obviously doing something wrong here. Here's the search string I'm using: host=MyHost* GET campaignID="*" clientID="*" memberID="*"| bucket _time span=1m | stats avg(time_taken) as avg by _time | where avg > 30 I open it in search and the search (all time) returns chunks of 5 minute results back to the software initial release. (returned 9k matches on 4M events). I had the alert scheduled on cron */5 * * * * and I have tried both number of results greater than 0 and with Trigger Condition Custom where avg(time_taken) > 30 Neither of them worked to actually generate email (email path is definitely working), or show up in the Triggered Alerts list. So my actual question's are 2: 1. Is this the right way to get the result I want, which is basically to check every 5 minutes to see if the average GET response is higher than 30 seconds. 2. Once I (we) figure out how to trigger the alert, is it going to blast me with results from all time, or just the last 5 minutes? ... View more