Splunk Search

How to create a (where) Alert parameter

albyva
Communicator

I'm using (where) to alert me if a field exceeds 80% but what I also need is to prevent it from
alerting if that field exceeds 100%. Here is what I have now:

| where bandwidth > 80

How can this be adjusted to be greater than 80, but less than 100?

Thanks,

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

As you can see in the documentation for where, that is just a simple AND;

<your_search> | where bandwidth > 80 AND bandwidth < 100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

/K

View solution in original post

kristian_kolb
Ultra Champion

As you can see in the documentation for where, that is just a simple AND;

<your_search> | where bandwidth > 80 AND bandwidth < 100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

/K

albyva
Communicator

Great. Thanks. Guess I missed that one. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...