Alerting

Help in setting alert

vrmandadi
Builder

Hello,

I am setting an alert based on the count i.e if the count is greater than 50 then we need to generate an alert.

I wrote the query and saved as alert

alert type=Real time
Trigger Condition=Custom
Custom Condition= search count>50
time: in 5 mins
and then selected the e-mail as triggered condition

in Throttle what should I give such that the alert when generated in 5 minutes should set the time back to zero before generating another alert

Tags (4)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

If your search is scheduled to run every five minutes (is it, actually?), then set the throttling to suppress the alert to something greater than five minutes.

0 Karma

vrmandadi
Builder

its not every 5 minutes,it will alert if the count is greater than 50 in a 5 mins window

0 Karma

ChrisG
Splunk Employee
Splunk Employee

So what is the schedule you have set for the search itself?

0 Karma

vrmandadi
Builder

all time for search,the alert is customized

search count>50

is the syntax correct for the alert or should it be in double quotes

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @vrmandadi,
I think it might be helpful to reconsider the alerting behavior you would like to have. When you say, "set the time back to zero" in your original question, it makes me think that you might want a scheduled alert that runs a search every five minutes to check for more than 50 events. If there are more than 50 results for that search, you get an email notification. Does that sound more like the outcome you are trying to set up? Let me know either way and I can suggest some resources.

As a start, this comparison chart might help.
http://docs.splunk.com/Documentation/Splunk/6.4.0/Alert/AlertTypesOverview

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...