Alerting

How to receive e-mail alert only once?

n37w0rk
Explorer

Hello everyone,

I'm still very new to the world of Splunk Enterprise. 😉 I hope that you can help me with my problem.

I created the following search to be notified of app updates by email:

Spoiler
| rest /services/apps/local
| search update.version != ""
| rename title AS Update_APP, version AS Update_Version, update.version AS Update_Versionupdate
| table Update_APP Update_Version Update_Versionupdate

The notification type is scheduled to run every day at 12:00 p.m. I chose one as a trigger. However, I get the same ban notification email every day, even though I've already received it.

What do I have to do so that the message is only sent once.

Please excuse my bad English.

Best regards
Björn

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @n37w0rk,

you could configure the throttle for your alert, in other words a period, after alert trigger, in which the message isn't sent.

You can configure throttle in alert proprties:

gcusello_0-1645089260757.png

Ciao.

Giuseppe

View solution in original post

n37w0rk
Explorer

It can be that easy. I was 100% sure I tested it. Now it's funny. Thanks for the quick help

krgds Björn

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @n37w0rk,

good for you, let me know if I can still help you.

If this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @n37w0rk,

you could configure the throttle for your alert, in other words a period, after alert trigger, in which the message isn't sent.

You can configure throttle in alert proprties:

gcusello_0-1645089260757.png

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...