topic Email Alerting error in Alerting

Email Alerting error

christinmb — Thu, 03 Jan 2013 16:19:29 GMT

Hi, I'm having error with the alerts sent by email since I upgraded to Splunk 5.
I have a real time alert search but Im getting this alert sent to my email all day with the same event and I think its something I did wrong in the configuration.
I attach the alert configuration, thanks in advanced.

Re: Email Alerting error

qjvtenkroode — Tue, 08 Jan 2013 13:41:55 GMT

This depends on the window in which the real-time search is run. For example lets assume a window of 30 min and the throttling you have configured (10 min). Now lets say the search has two results (seen at time 0), Splunk sends an email and keeps quiet for 10 min.

Now after 10 min the throttling is turned off and still these two events are seen since the window rolls over 30 min, this time at time 10. Thus another email is send and so on.

Solutions to this can be to decrease or increase the real-time window (once again I don't know your setting since it is not shown in the screenshot), to adjust the condition (ie. number of events greater than 10 instead of 1) or to adjust the throttling time to match the real-time window.

Re: Email Alerting error

christinmb — Tue, 08 Jan 2013 16:47:45 GMT

The time range i have is:
# start time: rt
# finish time: rt

Alert mode is in "once per results" with the same alert condition showed in the screen shot

And I disabled the Throttling option

Re: Email Alerting error

qjvtenkroode — Tue, 08 Jan 2013 16:57:37 GMT

Well by setting the search to rt, rt and the alert mode to "once per result" you will be alerted for every event after one event is found. (ie. the second, the third, the fourth and so on).

It really depends on what you're trying to achieve.