How to throttle Scheduled Alerts from spamming my inbox by just receiving one email related to all matching events?

[eliyyah]

Hello, I've search around and haven't found an answer on Splunk answers so maybe someone can help answer or give me a link with answer. Thanks

Scenario: I've scheduled an alert to report on web-based attacks to a specific website (it's a temp fix until we can get it moved behind F5). The cron is set to run every 24hrs at 8am. My trigger is set 'for each result' because I want the alerts separated when they fire. Triggering is suppressed for 24hrs to prevent alerting on event values with identical fields. Trigger action is set to email.

Challenge: Inbox overflowing with individual alerts. Rather than to receive an individual email for each result within the last 24 hr period, I'd like to receive one email with all of those matching events related to the one alert at 8 am. To be very clear, I want all of the alerts that come in (currently like almost 200 a day) to be on one email. I don't want 200 individual emails.

Thanks in advance!

[somesoni2 · Accepted solution]

In the Edit Alert page (from UI), in the page where you setup Alert Action as "Send email", scroll down to 'Action Options' sections (which has throttle checkbox), and change the "When triggered, execute actions" from 'For each result' to 'Once'.

[eliyyah]

Thanks someoni2. Let me try that and get back to you for credit ^_^

[eliyyah]

Thanks again. Looks like it worked.