topic Re: MS Teams alert for Splunk Addon triggering alerts n number of times in Splunk Enterprise

MS Teams alert for Splunk Addon triggering alerts n number of times

impurush — Thu, 17 Sep 2020 15:47:18 GMT

Hello Everyone,

I have integrated the "MS Teams alert for Splunk" add-on in my splunk cluster. I have added it in to alert action and triggering alerts n number of times.

Example: The alert has 5 result rows and I am getting 5 messages in MS teams however I need only one alert per trigger. I checked the alert configuration and the trigger action is set to as Once. In the same alert I have configured to send to my email and I am getting only once but in MS team I am getting 5 times.

Thanks in advance!

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

niketn — Sun, 20 Sep 2020 19:55:56 GMT

@impurush as the MS Teams alert for Splunk app is developer supported by the"Mitsui Bussan Secure Directions, Inc" (MBSD) team, please reach out to the Developer Contact provided in the App on Splunkbase i.e. splunksupport@mbsd.jp

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

impurush — Sun, 20 Sep 2020 23:11:35 GMT

Hi @niketn Thanks for reaching out to this post. I have tried to reach them via email, unfortunately, I did not get any response and hence I reached here in the community. I will try one mor time to reach them with my questions.

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

inventsekar — Mon, 21 Sep 2020 00:00:45 GMT

Hi, i am not sure of MS Teams addon.. by the by...
may i know if you try to find out which alert is generating the alerts and try to edit/update that alert?

(i have joined to 100 karma givers club, have you?!?!)

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

impurush — Mon, 21 Sep 2020 13:21:51 GMT

Hi @inventsekar, I have included the MS teams add-on in the respective alert. I have changed the alert to trigger only once if the alert triggers but still I am getting a lot of alerts when a single alert triggers.

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

inventsekar — Mon, 21 Sep 2020 13:25:21 GMT

hi @impurush the alert should have a "throttle" settings. pls check that one. The throttle setting controls how we can suppress the excess alerts.

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

impurush — Mon, 21 Sep 2020 13:43:10 GMT

Hi @inventsekar , I totally agree with you but the throttle setting is default.

Re: MS Teams alert for Splunk Addon triggering alerts n number of times

impurush — Wed, 23 Sep 2020 12:56:28 GMT

Thank you everyone for the replies and I got the reply from Developer Support from the App.

"MS Teams Connector are send the message for each results. please consider convene multiple results put together one result in Splunk."