Hello All, I need to alert when the perc75(totalfilter) value reached greater than 40000 within 10 mins or more. I am sharing my original query and now I am looking for the above condition to be append with the below query to trigger alert   index=clai_pd env=pd*cloud* perflog getprovider RASNewDispatch-Ext_RASDispatchDetailScreen-getProviderNext_act OR RASDispatchPage-RASDispatchPanelSet-RASDispatchCardPanel-getProvider_act | timechart span=10m perc50(totalfilter), perc75(totalfilter) by count ... View more

FYI -- Red marked URLs from the attached image should be remove from the output of splunk query which I shared below ..Please someone help for the same. Query used  in environment ===================== index=claims_pd env=pd_cloud_e sourcetype=claims:cif:ibuapps "https://" NOT "*.gco.net" NOT "*.gcoddc.net" NOT "*gco.net" | rex field=_raw "(?<externalURL>https:\/\/.[^\s]+)" | stats values(externalURL) as externalURL,list(ResponseMessage) as ResponseMessage, count by ServiceName | sort 0 - count | dedup externalURL |append [search sourcetype=claims:cif:ibuapps "javax.net.ssl.SSLException" OR "javax.net.ssl.SSLHandshakeException" OR "Unable to tunnel through proxy" OR "HTTP response '400: Bad Request'" OR "(504)Gateway Timeout" OR "Access is denied" AND (ServiceName OR (doFinally AND "method:handleErrorResponse")) | stats list(ResponseMessage) as ResponseMessage, count by ServiceName | sort - count | return ResponseMessage] ... View more