# Kibana "count by" in Alert monitor/trigger
**URL:** https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [December 28, 2020, 7:10pm UTC](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757 "2020-12-28T19:10:18Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@biker2o](https://discuss.elastic.co/u/biker2o)
#### Post date: [December 28, 2020, 7:10pm UTC](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757/1 "2020-12-28T19:10:18Z")
Hello. I am trying to figure out how to turn this Splunk alert into a kibana alert. Essentially, I want to be notified by Kibana when the count of ClientRequestHost is greater than 300 in a 1min period (or time span) for more than 20 mins straight. How can I accomplish this? How can I have a "count by" in a Kibana Alert/Trigger?
**Splunk alert I am trying to mimick in Kibana:**
ClientRequestMethod=POST AND (ClientRequestURI=_ValidateUsernameAndPassword_ OR ClientRequestURI=_Isotope/API/Isotope_) EdgePathingOp=wl
| bin \_time span=1m
| stats count by ClientRequestHost,\_time
| where count \> 300
| stats count by ClientRequestHost
| where count \> 20
**What I have created so far in Kibana monitor**
{
"version": true,
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"EdgeStartTimestamp": {
"from": "{{period\_end}}||-20m",
"to": "{{period\_end}}",
"include\_lower": true,
"include\_upper": true,
"boost": 1
}
}
}
],
"should": [
{ "match": { "ClientRequestURI": "Isotope/API/Isotope"}},
{ "match": { "ClientRequestURI": "ValidateUsernameAndPassword"}}
],
"minimum\_should\_match" : 1,
"filter": [
{ "term": { "EdgePathingOp.keyword": "wl"}},
{ "term": { "ClientRequestMethod.keyword": "POST" }}
]
}
}
}
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [December 30, 2020, 5:59pm UTC](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757/2 "2020-12-30T17:59:10Z")
This is one of the default alert types using Kibana watcher, which is documented here: [https://www.elastic.co/guide/en/kibana/7.10/watcher-ui.html](https://www.elastic.co/guide/en/kibana/7.10/watcher-ui.html)
If you don't see Watcher, you might be using OpenDistro. We don't offer support for OpenDistro in these forums because it's not an Elastic product.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2021, 5:59pm UTC](https://discuss.elastic.co/t/kibana-count-by-in-alert-monitor-trigger/259757/3 "2021-01-27T17:59:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.