Log-based detector requirements and limits
Review the supported search language, detector structure, conditions, scheduling, and organization limit.
Supported configuration
| Setting | Requirement or limit |
|---|---|
| Search language | SPL |
| Rules per detector | One log alert rule |
| Detectors per organization | 50 log-based detectors |
| Condition type | Count of search results |
| Comparison operators | Equal to, less than, and greater than |
| Minimum schedule interval | 5 minutes |
| Schedule and lookback | Configured separately |
Organization limit
Deactivated detectors count toward the 50-detector organization limit. A successfully deleted detector reduces capacity.
Limitations
Currently, the following features do not support log based alerting:
- SPL2 and automatic conversion between SPL and SPL2
- More than one log alert rule in a detector
- Advanced anomaly-detection or machine-learning conditions
- Automatic migration or conversion of existing metric detectors or Splunk-side alerts
- AI-assisted search creation
- A customer-facing API for log-based detectors