https://community.splunk.com/t5/Splunk-Search/Sql-search-and-duplicate-alerts/m-p/364188#M107496 <P>I have a search defined like this for the alert</P> <PRE><CODE>| dbxquery connection=MyDB query=usp_Splunk_GetDataForAlert shortnames=true output=csv </CODE></PRE> <P>My stored procedure looks a week back to determine if certain condition is met. The alert itself is set to run every hour. So if I have a condition that happened today I would be getting the same alert every hour until I pass that point. </P> <P>How can I make alert to go out once for each set of events that triggered it?</P> Mon, 26 Jun 2017 22:00:03 GMT aamelyan 2017-06-26T22:00:03Z https://community.splunk.com/t5/Splunk-Search/Sql-search-and-duplicate-alerts/m-p/364188#M107496 <P>I have a search defined like this for the alert</P> <PRE><CODE>| dbxquery connection=MyDB query=usp_Splunk_GetDataForAlert shortnames=true output=csv </CODE></PRE> <P>My stored procedure looks a week back to determine if certain condition is met. The alert itself is set to run every hour. So if I have a condition that happened today I would be getting the same alert every hour until I pass that point. </P> <P>How can I make alert to go out once for each set of events that triggered it?</P> Mon, 26 Jun 2017 22:00:03 GMT https://community.splunk.com/t5/Splunk-Search/Sql-search-and-duplicate-alerts/m-p/364188#M107496 aamelyan 2017-06-26T22:00:03Z https://community.splunk.com/t5/Splunk-Search/Sql-search-and-duplicate-alerts/m-p/364189#M107497 <P>hello there,<BR /> hope i understand the question correctly.<BR /> you can throttle the alert, read here:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.6.1/Alert/ThrottleAlerts">https://docs.splunk.com/Documentation/Splunk/6.6.1/Alert/ThrottleAlerts</A><BR /> hope it helps</P> Tue, 27 Jun 2017 01:53:09 GMT https://community.splunk.com/t5/Splunk-Search/Sql-search-and-duplicate-alerts/m-p/364189#M107497 adonio 2017-06-27T01:53:09Z