topic Re: Mutilple alerts coming for each search results in Alerting

Mutilple alerts coming for each search results

SG — Thu, 29 Jul 2021 07:39:43 GMT

HI,

I have configured an alert to get the email when my query gives greater than 0 search results. I am able to see the alert but if search results are 3 I am getting 3 different emails as below.

In the above screenshot, we can see that all 3 different emails are triggered at the same time. want all these results to be in one email alert. Can someone please help me with how can we get all the search results of a single alert?

Also in my alert trigger conditions, I have something like

does that mean my Splunk alert expires after 24 hours? If it is so how can I change the settings to work the alert forever and if I need to stop the alert I will disable it.

Thanks in advance,

Swetha. G

Re: Mutilple alerts coming for each search results

ITWhisperer — Thu, 29 Jul 2021 08:01:15 GMT

The 24 hours refers to how long the triggered alert stays in the list of triggered alerts (see under Activity/Triggered Alerts)

The other setting which you haven't shown is Trigger

How is yours set?

Re: Mutilple alerts coming for each search results

SG — Thu, 29 Jul 2021 09:30:54 GMT

I updated the Triggered value from "For each result" to once. Now I am getting all the search results in one alert email.

Thanks,