How to do it...

Follow the steps in this recipe to create an alert when there is a temperature sensor reading in your metrics data that exceeds an acceptable level:

  1. Log in to your Splunk server and select the Operational Intelligence application.
  2. Ensure that the time range picker is set to Last 5 Minutes, by clicking on the Advanced time picker section and changing the Earliest time to -5m@m:
  3. Type the following search in the Splunk search bar. Then, click on the magnifying glass icon or hit Enter:
| mstats max(_value) AS maxTemp WHERE index=hvac AND metric_name=sensor.temp AND server="*" by server, metric_name span=5m |where maxTemp>23 ...

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial