topic Re: Alert settings menu: What's the difference between "Per-Result" and "Number of Results" options? in Alerting

Alert settings menu: What's the difference between "Per-Result" and "Number of Results" options?

ddrillic — Fri, 27 Oct 2017 16:44:53 GMT

What's the difference between alerts' Per-Result and the Number of Results options?

We are not clear about the difference between them.

When we set it up like this, we get alerts from August. Why is that?

Re: Alert settings menu: What's the difference between "Per-Result" and "Number of Results" options?

lfedak_splunk — Fri, 27 Oct 2017 18:26:08 GMT

Hey @ddrillic, It looks like the Number of Results triggers based on custom # of results.
Select Save As > Alert.
Specify the following values for the fields in the Save As Alert dialog box.

    Title: Errors in the last 24 hours
    Alert type: Scheduled
    Time Range: Run every day
    Schedule: At 10:00
    Trigger condition: Number of Results
    Trigger when number of results: is greater than 5.

Select the Send Email alert action.
Set the following email settings, using tokens in the Subject and Message fields.

    To: email recipient
    Priority: Normal
    Subject: Too many errors alert: $name$
    Message: There were $job.resultCount$ errors reported on $trigger_date$.
    Include: Link to Alert and Link to Results

And per-result triggers every time there is a search result, although you can specify a time period and optional field values for suppression.

Re: Alert settings menu: What's the difference between "Per-Result" and "Number of Results" options?

ddrillic — Sat, 28 Oct 2017 01:57:55 GMT

About the alerts from August. Maybe they got stuck in the Unix mail queues - how do we clear them, if that's the case?

Re: Alert settings menu: What's the difference between "Per-Result" and "Number of Results" options?

ddrillic — Mon, 30 Oct 2017 22:46:38 GMT

Thank you @lfedak!