topic Re: Splunk alert to ignore user for a week in Alerting

Splunk alert to ignore user for a week

spodda01da — Wed, 09 Jun 2021 16:37:59 GMT

Hello All,

I am working on a unique request and was wondering if its possible.

The request is to run an alert every hour and if a user appears in the alert, it should ignore the same user for one week.

Need your help if it can be configured.

Thanks in advance,

Re: Splunk alert to ignore user for a week

isoutamo — Wed, 09 Jun 2021 16:48:22 GMT

your alert need to return all users by it’s own row if they are alerted. Then in alert dialog select alert per results and needed throttle time for that.

https://docs.splunk.com/Documentation/Splunk/8.2.0/Alert/AlertTriggerConditions

r. Ismo

Re: Splunk alert to ignore user for a week

spodda01da — Tue, 15 Jun 2021 17:59:54 GMT

Thanks for the response, I am going to test it further.

Re: Splunk alert to ignore user for a week

gjanders — Wed, 16 Jun 2021 04:59:16 GMT

In Alerts for Splunk Admins, https://splunkbase.splunk.com/app/3796/ or https://github.com/gjanders/SplunkAdmins

I have examples such as SearchHeadLevel - Users exceeding the disk quota introspection, where I use a lookup file to stop emailing users for a week. A separate report cleans up the lookup

That's another alternative...