Configuring Alerts

[MichaelBernas]

Hello,

I have been using splunk as a syslog server for a while now and have around 8 - 10 alerts tat I have created. I have recently had issues with creating any additional alerts and have pretty much determined that it is because I have hit a limit on how many real time alerts I have setup.

I am now going through all my alerts to see which ones I don't need to have real time alerting on. My question is this. I want to perform a search every 5 minutes...if a search comes up with a specific search string within that 5 minutes, I would like it to alert once for every time it is found.

Is this achieved just by setting up a basic schedule as well as setting the time range? And would I do something like having the start time at -5m and the finish time to now?

Thanks for your help....

[jtrucks]

Set up the search to run every five minutes, with the time interval as:

Start time: -5m@m Finish time: now

Next, Set "Alert mode" to "Once per result" to get a separate alert per result found rather than a single alert for the whole search across the 5 minutes.

Just be sure to set it up to send email and you are set.

[MichaelBernas]

Thanks jtrucks,

I had set the start time to -5m. What is the difference between what I set and -5m@m.

I appreciate the help!