topic Re: Alert set to medium severity but also creating high severity under alert list in Alerting https://community.splunk.com/t5/Alerting/Alert-set-to-medium-severity-but-also-creating-high-severity/m-p/475212#M12674 <P>@palisetty can you share the saved search details (configuration from <CODE>savedsearches.conf</CODE>) or configuration screenshots from front-end? Also by any chance do you have multiple alerts configured instead of one?</P> <P>Where are you seeing the above results, from Triggered Alert list or somewhere else? Please add more details for the community to assist you better.</P> <P>Before posting code/configuration or screenshot on Splunk Answers please ensure you mask/anonymize any sensitive information.</P> Sun, 05 Jan 2020 19:14:46 GMT niketn 2020-01-05T19:14:46Z Alert set to medium severity but also creating high severity under alert list https://community.splunk.com/t5/Alerting/Alert-set-to-medium-severity-but-also-creating-high-severity/m-p/475211#M12673 <PRE><CODE>2020-01-05 22:14:20 India Standard Time Splunk Web login attempts search Real-time High Per Result View results | Edit search | Delete 2020-01-05 22:14:20 India Standard Time login search Real-time Medium Digest View results | Edit search | Delete </CODE></PRE> <P>I set alert to medium severity and I set it to Once, not per result. I made 5 login failures continuously. At first, I got medium as expected but then I got High. Why is this behavior?</P> Sun, 05 Jan 2020 16:49:24 GMT https://community.splunk.com/t5/Alerting/Alert-set-to-medium-severity-but-also-creating-high-severity/m-p/475211#M12673 palisetty 2020-01-05T16:49:24Z Re: Alert set to medium severity but also creating high severity under alert list https://community.splunk.com/t5/Alerting/Alert-set-to-medium-severity-but-also-creating-high-severity/m-p/475212#M12674 <P>@palisetty can you share the saved search details (configuration from <CODE>savedsearches.conf</CODE>) or configuration screenshots from front-end? Also by any chance do you have multiple alerts configured instead of one?</P> <P>Where are you seeing the above results, from Triggered Alert list or somewhere else? Please add more details for the community to assist you better.</P> <P>Before posting code/configuration or screenshot on Splunk Answers please ensure you mask/anonymize any sensitive information.</P> Sun, 05 Jan 2020 19:14:46 GMT https://community.splunk.com/t5/Alerting/Alert-set-to-medium-severity-but-also-creating-high-severity/m-p/475212#M12674 niketn 2020-01-05T19:14:46Z