https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305290#M5484 <P>When the search frequency and time range are different (search runs every minute but looks back 2 hrs every time) there are events which will be overlapping in multiple alert execution, hence duplicate alerts. Best option is to keep them in sync, as suggested by @dineshraj9. Also, unless it's really critical, setup a less frequent alert like every 10 or 15 mins instead of every minute. Also, in time range, allow some additional gap to account for indexing latency.</P> <P>E.g. Search time range <CODE>earliest=-12m@m latest=-2m@m</CODE> with cron as <CODE>2/10 * * * *</CODE></P> Tue, 23 May 2017 21:33:35 GMT somesoni2 2017-05-23T21:33:35Z https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305287#M5481 <P>start time = -2h@h Finish Time = now.<BR /><BR /> Can I use this in an alert in Splunk.. which will run my search every minute for the last 2 hours and will throw an alert if gets any result. </P> Sun, 21 May 2017 04:29:09 GMT https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305287#M5481 loveforsplunk 2017-05-21T04:29:09Z https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305288#M5482 <P>Try running the search once and check how much time it takes. If you have huge volume of data being searched then ensure that there are not 2 concurrent execution. Setting up every minute for 2hr window would work fine, but if you are looking for a keyword in the raw events, it is advisable that the search window and frequency remain same.(search -2m@m to -1m@m every minute).</P> <P>Please check for timezone issue with the logs and fix them if any.</P> Sun, 21 May 2017 06:20:36 GMT https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305288#M5482 dineshraj9 2017-05-21T06:20:36Z https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305289#M5483 <P>I have one question here.. I am getting the alert when I kept the search as -2h@h to now but it seems it is taking from the beginning of hour. </P> <P>For ex: Suppose the search returns result at 10:36:18 AM and I get an alert at 12:36:18 PM . But I think it is searching from the beginning of hour that is 10 AM so I keep on getting continuous alert. Can You please suggest anything .</P> Tue, 23 May 2017 21:17:54 GMT https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305289#M5483 loveforsplunk 2017-05-23T21:17:54Z https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305290#M5484 <P>When the search frequency and time range are different (search runs every minute but looks back 2 hrs every time) there are events which will be overlapping in multiple alert execution, hence duplicate alerts. Best option is to keep them in sync, as suggested by @dineshraj9. Also, unless it's really critical, setup a less frequent alert like every 10 or 15 mins instead of every minute. Also, in time range, allow some additional gap to account for indexing latency.</P> <P>E.g. Search time range <CODE>earliest=-12m@m latest=-2m@m</CODE> with cron as <CODE>2/10 * * * *</CODE></P> Tue, 23 May 2017 21:33:35 GMT https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305290#M5484 somesoni2 2017-05-23T21:33:35Z https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305291#M5485 <P>oh .. I get it now .. Thanks a lot for instant reply. And also thanks to Dinesh .. I did not get what he wanted to express <span class="lia-unicode-emoji" title=":winking_face:">😉</span> Sorry Dinesh but Thanks to both of you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> I am very new to Splunk so asking silly questions . Hope you didn't mind <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 23 May 2017 21:54:39 GMT https://community.splunk.com/t5/Alerting/alert-in-splunk/m-p/305291#M5485 loveforsplunk 2017-05-23T21:54:39Z