topic Re: Allow skew in Alerting

Allow skew

toporagno — Tue, 05 Mar 2024 16:03:16 GMT

HI,

I need to know how to set and where the value of allow_skew for the Enterprise Security app, as I have many alerts triggering every 5 minutes.

thank you.

kiran_panchavat — Wed, 06 Mar 2024 15:42:41 GMT

@toporagno allow_skew value should be in the savedsearches.conf. You can set the value here.

kiran_panchavat — Wed, 06 Mar 2024 15:44:18 GMT

@toporagno Remember that savedsearches.conf is a per-app/user configuration file, and the order of precedence matters. Configuration file precedence - Splunk Documentation

richgalloway — Thu, 07 Mar 2024 01:47:52 GMT

allow_skew won't stop alerts from triggering every 5 minutes. To stop the alerts you have a few options

1) Stop whatever is triggering the alerts

2) Change the threshold of the alert so it's less likely to be triggered

3) Run the alert less frequently

4) Some combination of the above