Alerting

Alert for each result

monteirolopes
Communicator

Splunk is monitoring a file every 11 minutes.
An alert was created to receive an email for each event that matches.

Follow the alert's setting:

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: -1s@s
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

I don't know why, but I am receiving only one mail. In my case, two events matched.
Is the setup right?

Obs; The Throttle feature is not checked

Best regards,
Lopes.

0 Karma

sbbadri
Motivator

try below thing

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: now
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...