Well, it depends greatly on what you will be doing with Splunk. There is a different set of skills needed if you are using Splunk directly as a (power) user - running ad-hoc searches, creating alerts or reports. A bigger set of skills is needed to write big interactive dashboards. Another set of skills is needed to deploy and maintain Splunk environments. And yet another is writing apps that interface with Splunk or extend Splunk as custom commands or modular inputs. So there is - as usual - no single "one size fits all" response. You will most probably need the knowledge on User/Power User level whatever you do to be able to understand what Splunk is about and what you are doing even if you're dealing with another aspect of Splunk. And you can't really skip the experience part. In order to do stuff efficiently and properly with Splunk (as with any other tool) you have to get experience and work out an intuition based on that experience. ... View more

Ok, but what is the goal of your alert? If you just want to know whether you have less than 10Mevents you chose the worst possible way to do so. Why fetching all events if you only want their count? index=whatever source=something | stats count Is much much better. And if you use only indexed fields (or index name which technically isn't an indexed field but we can assume it is for the sake of this argument) which you do you can even do it lightning-fast as | tstats count WHERE index=whatever source=something ... View more