Alerting

How to set up an alert to run on a cron schedule every 5 minutes, stop triggering after 5 times in an hour, then trigger again after the 1 hour interval?

sympatiko
Communicator

Hi Splunkers,

Is it possible to do this on splunk alerts:

Cron running every 5 mins, if the triggered alerts already reached 5 in an hour, it will stop triggering. After the 1 hour interval it will start to trigger again. Is it possible?

Thanks,

1 Solution

stephanefotso
Motivator

Hello!

  1. you can cron your alert to run every 5 minutes.
  2. You can know if the number of alerts already reached 5, in hour.
  3. But you can not stop an alert, until you do it manually(Disable the alert) or you configure it to stop after certain time, when setting up your alert
  4. After an alert it Disabled, it can not start automatically, until you have Enabled it.

Means, what you are asking is not yet possible with splunk.
Thanks
Stephane

SGF

View solution in original post

stephanefotso
Motivator

Hello!

  1. you can cron your alert to run every 5 minutes.
  2. You can know if the number of alerts already reached 5, in hour.
  3. But you can not stop an alert, until you do it manually(Disable the alert) or you configure it to stop after certain time, when setting up your alert
  4. After an alert it Disabled, it can not start automatically, until you have Enabled it.

Means, what you are asking is not yet possible with splunk.
Thanks
Stephane

SGF

sympatiko
Communicator

Thanks! =D Have a great day

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...