Hello,
First of all, my Splunk version is "Splunk 5.0.2 build 149561"
I'm trying to create an alert based on the percentage of errors results. For example, if the error percentage is greater than or equal to 5%, I want to get an e-mail.
The search I'm using is:
MY SEARCH |WHERE id_cliente= "1" OR id_cliente= "2" | replace 1 with "CLIENT ONE" in id_cliente | replace 2 with "CLIENT TWO" in id_cliente | stats count as SENT, count(eval (type = "d")) as DELIVERY, count(eval (type = "b")) as BOUNCE by id_cliente, id_envio | eval PERCENT=round((BOUNCE*100)/SENT, 2) "%". | table id_cliente, id_envio, SENT, DELIVERY, BOUNCE, PERCENT | sort by -PERCENT
In "Manager >> Searches and reports" I tried the following configuration:
Alert
Condition >> if custom condition is met
Custom condition search >> "search PERCENT> = 5"
Please can you help me?
Thank you,
... View more