How to throttle Splunk alert configuration?

Veeru · ‎04-14-2023

Hello

I need some assistance please with the alert throttle functionality in splunk

Even though we have the alert throttle enabled & suppressed for 60mins the alert still seems to generate a trigger every 10mins @ 00:10, 00:20, 00:30, 00:40, and 00:50

I only want the 00:10 event to trigger & then suppress the 00:20, 00:30, 00:40 & 00:50 events.

Thank you in advance
Veeru

woodcock · ‎04-14-2023

Just setup throttling.

Veeru · ‎04-17-2023

@woodcock
I did it but it is not suppressing the alerts

woodcock · ‎04-17-2023

My answer was a passive-aggressive prod. You need to ADD DETAIL. Show us the entry in savedsearches.conf.

How to throttle Splunk alert configuration?

alert action

throttling

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

How to throttle Splunk alert configuration?

alert action

throttling

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...