https://community.splunk.com/t5/Alerting/Using-Throttle-and-selecting-the-right-field/m-p/511210#M9359 <P>Hi Splunk Team,</P><P>I have created an alert where i am checking the process status for two host in that alert in every 15 minutes.<BR />need to suppress the alerts&nbsp;for next two hours for each server respectively once generated.<BR /><BR />Lets just say, if alert generated for server A, it throws the alert and suppress it for next two hours for server A but not for server B or vice versa. In mean time if process fro server B goes down, i should get an alert&nbsp;<BR /><BR />in the search query I am using " <STRONG>stats count by host COMMAND _time</STRONG> ".<BR />and in&nbsp;Suppress results containing field value,&nbsp;I have given&nbsp;<STRONG>host,&nbsp;</STRONG>will that helps for my case.<BR /><BR />Thanks,<BR />Sushant&nbsp;</P><P><BR /><BR /><BR /></P> Mon, 27 Jul 2020 19:37:38 GMT sushantnarula 2020-07-27T19:37:38Z https://community.splunk.com/t5/Alerting/Using-Throttle-and-selecting-the-right-field/m-p/511210#M9359 <P>Hi Splunk Team,</P><P>I have created an alert where i am checking the process status for two host in that alert in every 15 minutes.<BR />need to suppress the alerts&nbsp;for next two hours for each server respectively once generated.<BR /><BR />Lets just say, if alert generated for server A, it throws the alert and suppress it for next two hours for server A but not for server B or vice versa. In mean time if process fro server B goes down, i should get an alert&nbsp;<BR /><BR />in the search query I am using " <STRONG>stats count by host COMMAND _time</STRONG> ".<BR />and in&nbsp;Suppress results containing field value,&nbsp;I have given&nbsp;<STRONG>host,&nbsp;</STRONG>will that helps for my case.<BR /><BR />Thanks,<BR />Sushant&nbsp;</P><P><BR /><BR /><BR /></P> Mon, 27 Jul 2020 19:37:38 GMT https://community.splunk.com/t5/Alerting/Using-Throttle-and-selecting-the-right-field/m-p/511210#M9359 sushantnarula 2020-07-27T19:37:38Z