https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482929#M12733 <P>I created an alert that outputs multiple application names when the alert query conditions are met. I want to receive a separate alert for each application and throttle each one for an hour. I tried using $result.application$ as the "suppress results containing field value" input, but that prevented any alerts coming in after the first one was created. Is there any way to throttle alerts for each specific value without having to manually type in each one, as there are hundreds. </P> <P>Thanks</P> Tue, 25 Feb 2020 21:26:02 GMT willcwhite 2020-02-25T21:26:02Z https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482929#M12733 <P>I created an alert that outputs multiple application names when the alert query conditions are met. I want to receive a separate alert for each application and throttle each one for an hour. I tried using $result.application$ as the "suppress results containing field value" input, but that prevented any alerts coming in after the first one was created. Is there any way to throttle alerts for each specific value without having to manually type in each one, as there are hundreds. </P> <P>Thanks</P> Tue, 25 Feb 2020 21:26:02 GMT https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482929#M12733 willcwhite 2020-02-25T21:26:02Z https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482930#M12734 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf">alert_action.conf</A></P> Wed, 26 Feb 2020 10:05:26 GMT https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482930#M12734 to4kawa 2020-02-26T10:05:26Z https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482931#M12735 <P>In savedsearches.conf</P> <PRE><CODE>[alert_name] action.email = 1 action.email.to = test@test.com alert.suppress = 1 alert.suppress.period = 1h alert.track = 1 counttype = number of events cron_schedule = 1 * * * * dispatch.earliest_time = -1h@-1m dispatch.latest_time = now </CODE></PRE> <P>This will email the result as a table and should suppress for next 1 hour until next search is executed</P> Thu, 27 Feb 2020 02:19:27 GMT https://community.splunk.com/t5/Alerting/Throttle-Alert-per-result-for-multiple-unique-values/m-p/482931#M12735 anmolpatel 2020-02-27T02:19:27Z