How to set up an alert to run on a cron schedule every 5 minutes, stop triggering after 5 times in an hour, then trigger again after the 1 hour interval?

[sympatiko]

Hi Splunkers,

Is it possible to do this on splunk alerts:

Cron running every 5 mins, if the triggered alerts already reached 5 in an hour, it will stop triggering. After the 1 hour interval it will start to trigger again. Is it possible?

Thanks,

[stephanefotso · Accepted solution]

Hello!

1. you can cron your alert to run every 5 minutes.
2. You can know if the number of alerts already reached 5, in hour.
3. But you can not stop an alert, until you do it manually(Disable the alert) or you configure it to stop after certain time, when setting up your alert
4. After an alert it Disabled, it can not start automatically, until you have Enabled it.

Means, what you are asking is not yet possible with splunk.
Thanks
Stephane

[sympatiko]

Thanks! =D Have a great day