Alerting

How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

wanda619
Path Finder

right now i have a cron expression like this - 0 * * * *

so the report is sent out every hour. How can i generate the report only once when the condition is triggered.

 

Thanks! 

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wanda619,

as @johnhuang said, you can set your alert to send only one message when the alert fires and not one for each result you have in your alert.

If you don't want to receive messages for a predefined time period after a firing, you can set the throttle.

Ciao.

Giuseppe

0 Karma

wanda619
Path Finder

@gcusello right now the alert is set in such way that report is being sent every hour, i am trying to find a way ,so that it sends one report per day.  cron expression i am using is 0 * * * *

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @wanda619,

if you see in the panel where you set the cron schedule, there's an option to throttle events (it's a check flag).

Flagging it you can say to Splunk that if an alert is fired, the alert must be runned again after 24 hours.

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

To limit the number of alerts to one per day, use the Throttle feature.  Edit the alert, check the "Throttle" box, then set the "Suppress triggering for" settings as shown.  Then click Save.

richgalloway_0-1667395185837.png

BTW, try to avoid scheduling alerts at minute 0.  This tends to be the most popular time for running searches so you risk searches being skipped if there aren't enough resources available.

 

---
If this reply helps you, Karma would be appreciated.

johnhuang
Motivator

Not sure if you want one time use alert or one alert per run. For the latter: configure the Trigger to "Once" which will limit the alert to one per run.

johnhuang_0-1667355901519.png

 

0 Karma

wanda619
Path Finder

@johnhuang yes specifically looking for one time use alert,, since now it i giving alert every hour. I am looking to set alert once at the beginning  

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...