topic Re: Need Help w/ Multiple Alert Emails in Alerting

Need Help w/ Multiple Alert Emails

joeybroesky — Tue, 09 Jun 2020 01:08:46 GMT

Need assistance figuring out why we are receiving multiple email alerts. We are trying to setup email alerts for Office365 Service Messages.

Search String

index="o365data" sourcetype="o365:service:message"  Id=*
 | where Classification == "Incident" AND Severity == "Sev2"
 | spath Messages{} output=Messages
 | spath WorkloadDisplayName
 | spath Id
 | spath Status
 | stats values(WorkloadDisplayName) as WorkloadDisplayName values(Id) as Id values(Status) as Status by Messages
 | spath input=Messages
 | eval PublishedTime=strptime(PublishedTime, "%Y-%m-%dT%H:%M:%S.%NZ")
 | eval CorrectPublished=PublishedTime+25200
 | where MessageText != "A post-incident report has been published."
 | stats count by CorrectPublished Id WorkloadDisplayName MessageText Status 
 | sort - CorrectPublished
 | dedup CorrectPublished
 | fields - count
 | eval CorrectPublished=strftime(CorrectPublished,"%Y/%m/%d %T")
 | fields - PublishedTime
 | dedup Id
 | table CorrectPublished Id WorkloadDisplayName MessageText Status
 | rename CorrectPublished as "Published", Id as "ID", WorkloadDisplayName as "Workload", MessageText as "Details"

Alert Settings
Alert Type: Real-time
Expires: 48 Hour(s)
Trigger alert when: Per-Result
Throtte: yes
Suppress results containing field value: *
Suppress triggering for: 2 minute(s)
When triggered: Send email

Emails Received

Re: Need Help w/ Multiple Alert Emails

richgalloway — Thu, 21 May 2020 17:30:32 GMT

Try changing Trigger alert when: Per-Result to Trigger alert when: Once.

Re: Need Help w/ Multiple Alert Emails

joeybroesky — Thu, 21 May 2020 19:03:30 GMT

Thanks Rich! I'll test this and report back!

Re: Need Help w/ Multiple Alert Emails

richgalloway — Thu, 28 May 2020 12:42:29 GMT

@joeybroesky If your problem is solved then please accept the answer to help future readers.

Re: Need Help w/ Multiple Alert Emails

joeybroesky — Thu, 28 May 2020 16:35:58 GMT

@richgalloway my apologies for the delay, I should be able to verify on the next alert.

Re: Need Help w/ Multiple Alert Emails

joeybroesky — Thu, 28 May 2020 20:56:52 GMT

This did the trick. Thanks again Rich!!