How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time?

[maniu1609]

How to create alert if specific event found first time in a day and ignore creating alert if the same event found second time in day?

We are indexing web services errors in Splunk. Here are some cases we are involved in.

1. We need to create an alert if we find an error text for a web service in a day. If we find the same error text for the same web service, then an alert shouldn't be created.

2. This scenario will be a tricky one. If the alert finds 2 error texts: For one error text , we already raise an alert as it is the first error in a day. For another error text we need to send alert as it's new now.

Please help me how we can handle this.

[HiroshiSatoh]

I think that you should use deterrence of alerts.
Set the field to be used for deterring and set the suppression period to 1 day.

[Vijeta]

What is the frequency of execution of alerts? you can search based on the time window if there are more than one events generated then set a variable as true or 1. Based on the value of variable you can have a conditional alert.

[maniu1609]

Thanks Viji. I have set frequency as 15 mins. Could you please with an example please.