Alerting

Alert for each result

monteirolopes
Communicator

Splunk is monitoring a file every 11 minutes.
An alert was created to receive an email for each event that matches.

Follow the alert's setting:

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: -1s@s
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

I don't know why, but I am receiving only one mail. In my case, two events matched.
Is the setup right?

Obs; The Throttle feature is not checked

Best regards,
Lopes.

0 Karma

sbbadri
Motivator

try below thing

Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: now
cron expression: */11 * * * *

Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...