https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391614#M114010 <P>I have a query for which I've configured a real-time alert when the query returns a result. I'm getting 25 to 35 emails and texts, and I really just need 1 of each. I'm not sure what I've set incorrectly here. </P> <P>index = chm source="<EM>CH_HealthMonitorHighLevel</EM>" <BR /> | fillnull value="" <BR /> | eval StartTime = relative_time(now(),"-10m") <BR /> | where _time &gt;= StartTime and (AppID == 16 or AppID == 41) <BR /> | where NOT StatusID == 0 AND NOT StatusID == 1</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6556i324B28D88CF749F4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 19 Feb 2019 21:15:51 GMT blindfire_bandi 2019-02-19T21:15:51Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391614#M114010 <P>I have a query for which I've configured a real-time alert when the query returns a result. I'm getting 25 to 35 emails and texts, and I really just need 1 of each. I'm not sure what I've set incorrectly here. </P> <P>index = chm source="<EM>CH_HealthMonitorHighLevel</EM>" <BR /> | fillnull value="" <BR /> | eval StartTime = relative_time(now(),"-10m") <BR /> | where _time &gt;= StartTime and (AppID == 16 or AppID == 41) <BR /> | where NOT StatusID == 0 AND NOT StatusID == 1</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6556i324B28D88CF749F4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 19 Feb 2019 21:15:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391614#M114010 blindfire_bandi 2019-02-19T21:15:51Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391615#M114011 <P>Real time searches run continuously and since, the window specified is 10 minutes, even for one result, it triggers multiple alerts. You can set the <STRONG>throttle to suppress triggering for 10 minutes</STRONG> (that way, the search waits for 10 minutes before triggering the alert again). Hope this helps</P> Wed, 20 Feb 2019 01:53:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391615#M114011 paranjith 2019-02-20T01:53:11Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391616#M114012 <P>Can you post a screenshot of the Trigger Condition?</P> <P>Also, is there a specific reason why you are using a real-time alert? Because real-time alerts are more costly in terms of computing resources than schedules alerts.</P> Wed, 20 Feb 2019 07:03:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391616#M114012 whrg 2019-02-20T07:03:03Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391617#M114013 <P>The alert is getting triggered repeatedly as the event will be populated multiple times in the 10 minute duration. If you run this search every 10 minutes you should get a single mail only.</P> Wed, 20 Feb 2019 11:44:36 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391617#M114013 bangalorep 2019-02-20T11:44:36Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391618#M114014 <P>@whrg It's attached to the question as alert.png. As far as the real-time is concerned, we're using real-time because we have single value panels that turn yellow to warn and red to indicate "down" for several applications. The operators who are on-call will only be interested in being alerted when something is at the warn or down state.</P> Wed, 20 Feb 2019 14:54:53 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391618#M114014 blindfire_bandi 2019-02-20T14:54:53Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391619#M114015 <P>@paranjith The throttling has fixed my issue. Thank you</P> Thu, 21 Feb 2019 17:28:21 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-real-time-alert-continue-to-send-emails-sms/m-p/391619#M114015 blindfire_bandi 2019-02-21T17:28:21Z