Alerting

Alert for each result

monteirolopes
Communicator

Splunk is monitoring a file every 11 minutes.
An alert was created to receive an email for each event that matches.

Follow the alert's setting:

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: -1s@s
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

I don't know why, but I am receiving only one mail. In my case, two events matched.
Is the setup right?

Obs; The Throttle feature is not checked

Best regards,
Lopes.

0 Karma

sbbadri
Motivator

try below thing

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: now
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...