×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Akdeveloper
Observer
Member since: ‎07-22-2023
‎07-23-2023
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎07-22-2023
View All

Re: Setting Rolling seven day average alert with c...

by in Other Usage
‎07-23-2023 06:12 AM
‎07-23-2023 06:12 AM
That's correct @ITWhisperer  ... View more

Re: Setting Rolling seven day average alert with c...

by in Other Usage
‎07-23-2023 04:31 AM
‎07-23-2023 04:31 AM
Sorry there was typo,this is correct if currently,if((IndividualCount>SevenDayAverage),"true","false"). Reg the query I am trying to compare counts in last three hours with seven day average count,if true then alert. I didn't tried metasearches,will give a try too ... View more

Setting Rolling seven day average alert with curre...

by in Other Usage
‎07-22-2023 03:55 PM
‎07-22-2023 03:55 PM
Hi, I am trying to setup an alert and notify by email, when count of last 3hrs is greater than rolling average of last 7 days using the below query. Query is working fine but in the alert is not working/not getting triggered I tried as below Alert Config Trigger conditions in alert Screen are, Trigger alert when ,Custom option ,search alert==true   Query: sourcetype="cloudwatch" index=***** earliest=-6d@d latest=@d |bucket _time span=1d |stats count by _time |stats avg(count) as SevenDayAverage |appendcols [search sourcetype="cloudwatch" index=***** |stats count as IndividualCount] |eval alert = if((IndividualCount.SevenDayAverage),"true","false") SevenDayAverage IndividualCount alert 5 1139 true ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-23-2023 09:34 AM