Built-in alert conditions 🔗

When you create rules in detectors to specify conditions that trigger alerts, Splunk Infrastructure Monitoring provides a number of built-in conditions that detect common problem scenarios. Many of these alert conditions provide more powerful ways of monitoring signals than the standard practice of comparing a signal to a static threshold.

The following table summarizes the available built-in alert conditions. To learn more about each condition, select the name of the condition.

Condition	Description	Example
Static Threshold	Alert when a signal crosses a static threshold	Availability over the last day is below 99.9.
Heartbeat Check	Alert when a signal has stopped reporting for some time	`Host-linux-001` has not reported for 15 minutes.
Resource Running Out	Detect when a signal is projected to reach a specified minimum or maximum value	`disk_space_available` is projected to decrease to zero within 24 hours. `cpu.utilization` is projected to reach 95 within 2 hours.
Outlier Detection	Alert when the signal from one data source differs from similar data sources	The number of logins in the last 10 minutes for this instance is 3 standard deviations lower than other instances in the same AWS availability zone.
Sudden Change	Alert when a signal is different from its normal behavior (based on mean of preceding window or percentile of preceding window)	All the values for `cpu.utilization` received in the last 15 minutes are at least 3 standard deviations higher than the mean of the preceding hour. All the values for `latency` received in the last 10 minutes are greater than 99% of the values of the preceding 1 hour.
Historical Anomaly	Alert when a signal differs by a specified amount when compared to similar periods in the past	The average number of logins in the last 2 hours is 3 standard deviations higher than the average for this same 2 hours last week.
Custom threshold	Alert when a signal crosses another signal, or when you want to specify compound conditions using AND and OR operators.	The value for `cache_misses` is above `cache_hits` OR the value for `cache_misses_percent` is above 10.

This page was last updated on Oct 17, 2024.

Was this topic useful?

Did you know that you can edit this page? Learn how!

Was this documentation topic helpful?

Enter your email address if you would like someone from the documentation team to reply to your question or suggestion.

Please provide your comments here. Ask a question or make a suggestion.

Comment should have a minimum of 5 characters and a maximum of 1,000 characters.

Feedback submitted, thank you! We resolve documentation feedback based on the severity of the issue reported, as well as an assessment of the potential number of customers who might be affected.

If you have a question about using Splunk software, we encourage you to check Splunk Answers or Splunk community Slack to see if similar questions have been answered, or to post your question for others to answer. If you have an active support entitlement and believe that your situation is caused by a product defect, file a support case in the Support portal https://login.splunk.com/page/sso_redirect?type=portal.

We are currently moving to a new documentation site. Expect a delay in responding to your feedback and applying any updates based on your feedback. Thank you for your patience and understanding while we work to bring you an improved documentation experience!