Email Alerting error

[christinmb]

Hi, I'm having error with the alerts sent by email since I upgraded to Splunk 5.
I have a real time alert search but Im getting this alert sent to my email all day with the same event and I think its something I did wrong in the configuration.
I attach the alert configuration, thanks in advanced.

[qjvtenkroode]

This depends on the window in which the real-time search is run. For example lets assume a window of 30 min and the throttling you have configured (10 min). Now lets say the search has two results (seen at time 0), Splunk sends an email and keeps quiet for 10 min.

Now after 10 min the throttling is turned off and still these two events are seen since the window rolls over 30 min, this time at time 10. Thus another email is send and so on.

Solutions to this can be to decrease or increase the real-time window (once again I don't know your setting since it is not shown in the screenshot), to adjust the condition (ie. number of events greater than 10 instead of 1) or to adjust the throttling time to match the real-time window.

[qjvtenkroode]

Well by setting the search to rt, rt and the alert mode to "once per result" you will be alerted for every event after one event is found. (ie. the second, the third, the fourth and so on).

It really depends on what you're trying to achieve.

[christinmb]

The time range i have is:
# start time: rt
# finish time: rt

Alert mode is in "once per results" with the same alert condition showed in the screen shot

And I disabled the Throttling option