topic Re: How to write throttle alert? in Alerting

How to write throttle alert?

nanachu — Tue, 03 Sep 2019 00:34:38 GMT

Hi,all

I have a question about how to write throttle alert.

I want to specify two fields.

But, I can not find document.

my field is "name" and "region".

I think name AND region OR name, region

If you know that, please help me.

Thank you.

Re: How to write throttle alert?

kamlesh_vaghela — Tue, 03 Sep 2019 04:50:04 GMT

@nanachu

I have a workaround. Can you please update your search by adding a new field?

YOUR_SEARCH | eval throttle_field = name."_".region

Use throttle_field filed as suppress results containing field value.

Can you please try this?

Re: How to write throttle alert?

nanachu — Tue, 03 Sep 2019 04:54:35 GMT

Thank you for helping me.

I can understand I have to make new field.
But, I have a question.
What is it means (."_".)?
it means instead of AND?

Re: How to write throttle alert?

jawaharas — Tue, 03 Sep 2019 05:24:41 GMT

It's just a character used concatenation of two strings. You can use any other letters or symbols. It's just for better readability.

Re: How to write throttle alert?

nanachu — Tue, 03 Sep 2019 06:14:20 GMT

Thank you for helping me.

I'm sorry but I don't understand much.
Could you help me?

I want to suppress name AND region.
for example,
name=A ,region=singapore

if I use

|eval throttle_field = name." ".region

I thought that is Asingapore.

I want to suppress the same name and region.
(in this case, A and singapore is trigger)

Can I use ."_".?

If my English is bad, I'm really sorry.

Regards,

Re: How to write throttle alert?

kamlesh_vaghela — Tue, 03 Sep 2019 06:19:37 GMT

@nanachu

Yes, you can use _.

As per your requirement throttling should be on name=A and region=singapore.

Means if any events arrive with the same field value then it should only consider if the duration between last occurrence and present occurrence is more than the defined throttle period.

here we have provided throttle_field which is representing as throttling field with required values A_singapore.

Re: How to write throttle alert?

jawaharas — Tue, 03 Sep 2019 06:22:36 GMT

@nanachu You are doing good.

 <YOUR_SEARCH> | eval throttle_field = name."_".region

It's better to use underscore, rather than a space for this purpose. After you modifying your query as mentioned above, just add the new field name - throttle_field in the
'Suppress results containing field value' input box in the 'Create Alert' configuration.

Re: How to write throttle alert?

nanachu — Tue, 03 Sep 2019 06:27:55 GMT

Thank you for your kind answer.
I understand so much.

Thank you.

Re: How to write throttle alert?

nanachu — Tue, 03 Sep 2019 06:28:42 GMT

Thank you for your kind answer.

I can understand!

Thank you.

Re: How to write throttle alert?

snigdhasaxena — Tue, 03 Sep 2019 06:47:21 GMT

@nanachu change trigger alert when to "once per result" and this will enable field "Per result throttling field" and there you can put your field value pairs for throttling

Re: How to write throttle alert?

kamlesh_vaghela — Tue, 03 Sep 2019 07:06:29 GMT

@nanachu

Does this answer solved your issue?? If yes then can you please accept this answer to close this question?? If No please let us know so we can help you further on it.

Happy Splunking