Alerting

Alert throttling

yashaswinig2210
Engager

I want to trigger an email alert whenever an account is locked on a machine

stats values(MachineName) as Machinename by Account, Email, _time

AccountMachinenameEmail_time
JohnMachine1
Machine2
John@gmail.com1:00 PM
 
JohnMachine2John@gmail.com2:00 PM

 

I have set up the alert to run for every 5mins and trigger only once in 24hr 

suppression value: Account, Machinename

Issue: the email is getting triggered twice at 1:00pm and 2:00pm again even the machine name is same.

Im not sure if it is considering only machine1 when triggering 1st mail.

Request you to please help.

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...