topic Re: Throttling does not send multiple emails in Splunk Search

Throttling does not send multiple emails

bsizemore — Fri, 25 Apr 2014 21:31:34 GMT

Hi,

I have my throttle set to send an email for each result, but of the 3 I expect I am only getting 1. What am I doing wrong?

index=something sourcetype=something serviceName=comparator NOT errorCode=abc123 level=ERROR 
| multikv
| stats count by masterId message
| search count >44 
| table masterId count message 
| rename message as "Repeated Error Message"

tmpdmp.com/b14cec96f23eb0dd/0e4c331c27983435

Re: Throttling does not send multiple emails

martin_mueller — Fri, 25 Apr 2014 23:07:50 GMT

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

Re: Throttling does not send multiple emails

bsizemore — Fri, 25 Apr 2014 23:55:41 GMT

I removed the quotation marks, but it still doesn't work. I will use the alternate method you mentioned. Thanks for the reply.

Re: Throttling does not send multiple emails

martin_mueller — Sat, 26 Apr 2014 00:06:17 GMT

Odd, this alert appears to throttle correctly for me: