Alerting

How to configure Splunk Alerts to only send one E-mail notification?

johann2017
Explorer

My Splunk alerts are configured to send an e-mail when triggered. How do I make sure that Splunk only sends one e-mail? It seems to be sending two e-mails every time. I think it may have to do with the timing I have configured. My alert settings are as follows:

Settings
Alert Time: Scheduled
Run on Cron Schedule
Time Range: Last 15 Minutes
Cron Expression: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The cron expression translates to At every 10th minute

Trigger Conditions
Trigger Alert When: Number of Results is greater than 0
Trigger: Once
Throttle: (not checked)

1 Solution

nplamondon
SplunkTrust
SplunkTrust

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

View solution in original post

0 Karma

nplamondon
SplunkTrust
SplunkTrust

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

0 Karma

johann2017
Explorer

Ok cool let me test that out and will post again after. Thanks.

0 Karma

johann2017
Explorer

This worked thank you!

0 Karma

rakshithreddy
Explorer

Hi @johann2017

The cron expression given above is wrong, can you check it

0 Karma

johann2017
Explorer

Hello Rak. The Cron Expression is: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The Cron expression translates to At every 10th minute.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...