Allow skew

[toporagno]

HI,

I need to know how to set and where the value of allow_skew for the Enterprise Security app, as I have many alerts triggering every 5 minutes.

thank you.

[richgalloway]

allow_skew won't stop alerts from triggering every 5 minutes.  To stop the alerts you have a few options

1) Stop whatever is triggering the alerts

2) Change the threshold of the alert so it's less likely to be triggered

3) Run the alert less frequently

4) Some combination of the above

[kiran_panchavat]

@toporagno Remember that savedsearches.conf is a per-app/user configuration file, and the order of precedence matters. Configuration file precedence - Splunk Documentation

[kiran_panchavat]

@toporagno allow_skew value should be in the savedsearches.conf. You can set the value here. 

For reference the link to the official documentation : Offset scheduled search start times - Splunk Documentation