I have been using splunk as a syslog server for a while now and have around 8 - 10 alerts tat I have created. I have recently had issues with creating any additional alerts and have pretty much determined that it is because I have hit a limit on how many real time alerts I have setup.
I am now going through all my alerts to see which ones I don't need to have real time alerting on. My question is this. I want to perform a search every 5 minutes...if a search comes up with a specific search string within that 5 minutes, I would like it to alert once for every time it is found.
Is this achieved just by setting up a basic schedule as well as setting the time range? And would I do something like having the start time at -5m and the finish time to now?