topic Re: How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time? in Alerting https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391703#M6884 <P>What is the frequency of execution of alerts? you can search based on the time window if there are more than one events generated then set a variable as true or 1. Based on the value of variable you can have a conditional alert.</P> Tue, 25 Sep 2018 14:48:39 GMT Vijeta 2018-09-25T14:48:39Z How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time? https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391702#M6883 <P>How to create alert if specific event found first time in a day and ignore creating alert if the same event found second time in day?</P> <P>We are indexing web services errors in Splunk. Here are some cases we are involved in.</P> <OL> <LI><P>We need to create an alert if we find an error text for a web service in a day. If we find the same error text for the same web service, then an alert shouldn't be created.</P></LI> <LI><P>This scenario will be a tricky one. If the alert finds 2 error texts: For one error text , we already raise an alert as it is the first error in a day. For another error text we need to send alert as it's new now.</P></LI> </OL> <P>Please help me how we can handle this.</P> Tue, 25 Sep 2018 13:21:17 GMT https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391702#M6883 maniu1609 2018-09-25T13:21:17Z Re: How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time? https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391703#M6884 <P>What is the frequency of execution of alerts? you can search based on the time window if there are more than one events generated then set a variable as true or 1. Based on the value of variable you can have a conditional alert.</P> Tue, 25 Sep 2018 14:48:39 GMT https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391703#M6884 Vijeta 2018-09-25T14:48:39Z Re: How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time? https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391704#M6885 <P>Thanks Viji. I have set frequency as 15 mins. Could you please with an example please.</P> Tue, 25 Sep 2018 14:57:49 GMT https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391704#M6885 maniu1609 2018-09-25T14:57:49Z Re: How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time? https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391705#M6886 <P>I think that you should use deterrence of alerts.<BR /> Set the field to be used for deterring and set the suppression period to 1 day.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5830i68340DF4E73D6553/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 27 Sep 2018 01:01:20 GMT https://community.splunk.com/t5/Alerting/How-do-I-create-an-alert-that-triggers-when-a-specific-event-is/m-p/391705#M6886 HiroshiSatoh 2018-09-27T01:01:20Z