https://community.splunk.com/t5/Alerting/a-real-time-alert-error/m-p/541313#M10244 <P>Hello, I want to create a real-time alert. I call the rest interface：</P><P>https://&lt;host&gt;:&lt;mPort&gt;/services/saved/searches</P><P>, and the parameter is:&nbsp; &nbsp;is_ visible=1&amp;cron_ Schedule = * * * * * &amp; Description = real time data 25 &amp; alert_ comparator=greater than&amp; alert.digest_ mode=0&amp; action.webhook.param .url= www.ceshi:8099/splunk/webhook/alert&amp; dispatch.earliest_ time=rt-60s&amp;alert_ threshold=30&amp;realtime_ schedule=true&amp;alert_ type=number of events&amp;search=ip=192.168.21.222&amp; alert.expires=15d&amp;name=417218432270925848&amp;output_ mode=json&amp; dispatch.latest_ time=rt-0s&amp;disabled=0&amp;is_ scheduled=true&amp;actions=webhook</P><P>However, the error display is returned: 400 bad request: [{"messages": [{"type": "error", "text": "per result alert throttling require at least one throttling field, use * to throttle on all fields"}]}]，</P><P>Is there a problem with the parameter I passed? Or is there an error in the SPL statement?</P> Thu, 25 Feb 2021 08:02:32 GMT splunk-user 2021-02-25T08:02:32Z https://community.splunk.com/t5/Alerting/a-real-time-alert-error/m-p/541313#M10244 <P>Hello, I want to create a real-time alert. I call the rest interface：</P><P>https://&lt;host&gt;:&lt;mPort&gt;/services/saved/searches</P><P>, and the parameter is:&nbsp; &nbsp;is_ visible=1&amp;cron_ Schedule = * * * * * &amp; Description = real time data 25 &amp; alert_ comparator=greater than&amp; alert.digest_ mode=0&amp; action.webhook.param .url= www.ceshi:8099/splunk/webhook/alert&amp; dispatch.earliest_ time=rt-60s&amp;alert_ threshold=30&amp;realtime_ schedule=true&amp;alert_ type=number of events&amp;search=ip=192.168.21.222&amp; alert.expires=15d&amp;name=417218432270925848&amp;output_ mode=json&amp; dispatch.latest_ time=rt-0s&amp;disabled=0&amp;is_ scheduled=true&amp;actions=webhook</P><P>However, the error display is returned: 400 bad request: [{"messages": [{"type": "error", "text": "per result alert throttling require at least one throttling field, use * to throttle on all fields"}]}]，</P><P>Is there a problem with the parameter I passed? Or is there an error in the SPL statement?</P> Thu, 25 Feb 2021 08:02:32 GMT https://community.splunk.com/t5/Alerting/a-real-time-alert-error/m-p/541313#M10244 splunk-user 2021-02-25T08:02:32Z