Alerting

How to set up an alert to run on a cron schedule every 5 minutes, stop triggering after 5 times in an hour, then trigger again after the 1 hour interval?

sympatiko
Communicator

Hi Splunkers,

Is it possible to do this on splunk alerts:

Cron running every 5 mins, if the triggered alerts already reached 5 in an hour, it will stop triggering. After the 1 hour interval it will start to trigger again. Is it possible?

Thanks,

1 Solution

stephanefotso
Motivator

Hello!

  1. you can cron your alert to run every 5 minutes.
  2. You can know if the number of alerts already reached 5, in hour.
  3. But you can not stop an alert, until you do it manually(Disable the alert) or you configure it to stop after certain time, when setting up your alert
  4. After an alert it Disabled, it can not start automatically, until you have Enabled it.

Means, what you are asking is not yet possible with splunk.
Thanks
Stephane

View solution in original post

stephanefotso
Motivator

Hello!

  1. you can cron your alert to run every 5 minutes.
  2. You can know if the number of alerts already reached 5, in hour.
  3. But you can not stop an alert, until you do it manually(Disable the alert) or you configure it to stop after certain time, when setting up your alert
  4. After an alert it Disabled, it can not start automatically, until you have Enabled it.

Means, what you are asking is not yet possible with splunk.
Thanks
Stephane

sympatiko
Communicator

Thanks! =D Have a great day

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...