Hi,
I am using the following search for monitoring number of Threads on a server:
index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date
and I want to set up an alert to be triggered when conditions are met (custom alert): Threads > 1600. But Splunk does not allow me to specify this condition in the alert "threads > 1600".
Could you please help me in resolving this? Thanks,
Try providing the condition as search Threads > 1600
in the condition box.
Another way to do is including the condition in the search itself and alert when Number of Results
is greater than '0'
ie
index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date|search Threads > 1600
and then selecting the drop down Number of Results is greater than 0
Try providing the condition as search Threads > 1600
in the condition box.
Another way to do is including the condition in the search itself and alert when Number of Results
is greater than '0'
ie
index=perfmon host=CCEVPSYCA01 sourcetype="Perfmon:System" counter=Threads| eval Date=strftime(_time, "%Y-%m-%d %H:%M") | rename Value AS Threads | table Date, Threads | SORT BY Date|search Threads > 1600
and then selecting the drop down Number of Results is greater than 0
Hello,
Great! Thanks - first option worked for me!
Good to know. Please accept as answer so that the thread will be closed
Done, thank you!