Alerting

Alert for each result

monteirolopes
Communicator

Splunk is monitoring a file every 11 minutes.
An alert was created to receive an email for each event that matches.

Follow the alert's setting:

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: -1s@s
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

I don't know why, but I am receiving only one mail. In my case, two events matched.
Is the setup right?

Obs; The Throttle feature is not checked

Best regards,
Lopes.

0 Karma

sbbadri
Motivator

try below thing

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: now
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

0 Karma