How to configure Splunk Alerts to only send one E-mail notification?

[johann2017]

My Splunk alerts are configured to send an e-mail when triggered. How do I make sure that Splunk only sends one e-mail? It seems to be sending two e-mails every time. I think it may have to do with the timing I have configured. My alert settings are as follows:

Settings
Alert Time: Scheduled
Run on Cron Schedule
Time Range: Last 15 Minutes
Cron Expression: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The cron expression translates to At every 10th minute

Trigger Conditions
Trigger Alert When: Number of Results is greater than 0
Trigger: Once
Throttle: (not checked)

[nplamondon · Accepted solution]

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

[johann2017]

Ok cool let me test that out and will post again after. Thanks.

[johann2017]

This worked thank you!

[rakshithreddy]

Hi @johann2017

The cron expression given above is wrong, can you check it

[johann2017]

Hello Rak. The Cron Expression is: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The Cron expression translates to At every 10th minute.