Hi sbeamro, Have you tried using a macro? http://docs.splunk.com/Documentation/Splunk/6.2.1/Search/Usesearchmacros Alternatively, you can add the search to a dashboard table and click on the dashboard to view it. Thanks! ... View more

All three should output events per second, no hidden kilos. 150000 events per second on a single indexer would be quite a lot for an average. ... View more

To edit the scheduling of the alert do the following: Save the search as a report (or alert) Go to settings > searches, reports and alerts Click on the name of the report/alert Check the box "Schedule this search" The first option should be how frequently you run the report/alert. Schedule type is either basic or cron. If you select basic it will give you options such as "every minute" or "every hour". If you select cron, you will be allowed to enter the exact cron format of how you want the job to run. Hope this helps ... View more

I was refering to the script which is configured for a realtime alert. I personally feel there is not much use of a realtime alert. rather schedule it to run every minute or two. It will affect the performance for sure as the CPU core will be occupied. There is no best practice available currently but you will know this by experimenting in your test environment. ... View more

YAY I got it to work ! I really apprecaite your help ! ... View more

If it answered your question, feel free to do so 😉 ... View more

I assume you get the alert every 4 hours once you started getting past the 90%?? If so, you can change the Alert setting "Alert Mode" to "Once per result" and uncheck 'Throttling'. I had to do this on our system to avoid constant emails. ... View more

I've tried to change it to false - nothing has changed 😞 ... View more

You're welcome! ... View more