Alerting

Alerting splunk

arunsundaram
New Member

we have Splunk log monitoring alert configured for x occurrences in 5 minutes so in 30 minutes, we get around 6 incidents.
We would like to have a solution to have just one incident until first issue is fixed. Is there any way to achieve

Tags (1)
0 Karma
1 Solution

Azeemering
Builder

You can supress alerts using the throttle tickbox in the alert configuration:

See screenshot:
https://imgur.com/ot9BVzp

See documentation:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Alert/ThrottleAlerts

View solution in original post

0 Karma

Azeemering
Builder

You can supress alerts using the throttle tickbox in the alert configuration:

See screenshot:
https://imgur.com/ot9BVzp

See documentation:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Alert/ThrottleAlerts

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...