https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277872#M5117 <P>Hi,<BR /> Please try to set the below setting with your preferred field. Always try to table to data you require. Moreover the throttling period is only 1 minute, so if you have events matching it will generate the alert. If you want hourly then throttle it to send 1 hour per host in the suppress triggering option.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1431i27ADF9204B0E98BC/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Thanks,<BR /> L</P> Thu, 02 Jun 2016 09:38:42 GMT linu1988 2016-06-02T09:38:42Z https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277871#M5116 <P>I have a simple search: </P> <PRE><CODE>host=*prod* "Too many open files" source!="/opt/atlassian/jira-data/log/emh.log*" </CODE></PRE> <P>I've set up a simple alert. Real-time, throttling on host for 1 minute. (pic attached)</P> <P>We had 200+ of these errors, all within 2 seconds of each other, from a single host 2 hours ago. Since then, we've received no less than 24 emails alerting us of those events. I want one email, not 24.</P> <P>What have I misconfigured?</P> <P>Thanks!</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1432iC39B05C5DD6DBFB2/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 01 Jun 2016 19:36:35 GMT https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277871#M5116 di2esysadmin 2016-06-01T19:36:35Z https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277872#M5117 <P>Hi,<BR /> Please try to set the below setting with your preferred field. Always try to table to data you require. Moreover the throttling period is only 1 minute, so if you have events matching it will generate the alert. If you want hourly then throttle it to send 1 hour per host in the suppress triggering option.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1431i27ADF9204B0E98BC/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Thanks,<BR /> L</P> Thu, 02 Jun 2016 09:38:42 GMT https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277872#M5117 linu1988 2016-06-02T09:38:42Z https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277873#M5118 <P>Thank you. I've made these changes. I've my fingers crossed this will do the trick.</P> Wed, 22 Jun 2016 19:45:21 GMT https://community.splunk.com/t5/Alerting/Why-does-my-real-time-alert-continue-to-send-emails-for-events/m-p/277873#M5118 di2esysadmin 2016-06-22T19:45:21Z