Splunk Octoblu Alert Search

savedsearches.conf

[ICA RTT - Yellow]
action.email.reportServerEnabled = 0
action.email.useNSSubject = 1
action.script = 1
action.script.filename = octoblu_trigger.py
alert.digest_mode = True
alert.suppress = 1
alert.suppress.period = 1m
alert.track = 0
counttype = number of events
cron_schedule = * * * * *
dispatch.earliest_time = rt
dispatch.latest_time = rt
display.general.type = statistics
display.page.search.tab = statistics
display.visualizations.charting.chart = radialGauge
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = octoblu
request.ui_dispatch_view = search
search = sourcetype="ICA:RTT"  ICARTT > 30 ICARTT < 60  | eval url="your Octoblu trigger URL" | eval alert_level="Yellow"
disabled = 0