https://community.splunk.com/t5/Splunk-Search/Stop-recurring-alerts/m-p/17142#M2349 <P>I have setup alerts based on a scheduled search in the logs. The application writes a log messages every minute while the error persists, therefore splunk gives out an email per message.</P> <P>can some one help me with a syntax to avoid reading recurring alerts...</P> <P>I am clueless in how to approach this problem...ignorance.</P> <P>Thanks.</P> Sat, 10 Jul 2010 05:15:48 GMT sureshchinta 2010-07-10T05:15:48Z https://community.splunk.com/t5/Splunk-Search/Stop-recurring-alerts/m-p/17142#M2349 <P>I have setup alerts based on a scheduled search in the logs. The application writes a log messages every minute while the error persists, therefore splunk gives out an email per message.</P> <P>can some one help me with a syntax to avoid reading recurring alerts...</P> <P>I am clueless in how to approach this problem...ignorance.</P> <P>Thanks.</P> Sat, 10 Jul 2010 05:15:48 GMT https://community.splunk.com/t5/Splunk-Search/Stop-recurring-alerts/m-p/17142#M2349 sureshchinta 2010-07-10T05:15:48Z https://community.splunk.com/t5/Splunk-Search/Stop-recurring-alerts/m-p/17143#M2350 <P>Check out the alert throttle app:</P> <P><A href="http://blogs.splunk.com/2010/06/01/alert-throttling/" rel="nofollow">http://blogs.splunk.com/2010/06/01/alert-throttling/</A></P> <P>It should help to reduce the number of alerts you receive. You could run your saved search once a minute but only receive notifications once an hour (or whatever interval you like) after the first alert is generated.</P> Mon, 12 Jul 2010 12:27:20 GMT https://community.splunk.com/t5/Splunk-Search/Stop-recurring-alerts/m-p/17143#M2350 Jeremiah 2010-07-12T12:27:20Z