How to trigger alerts based on whether or not an event has triggered before?

[avoelk]

I currently have the issue that I want to trigger a certain alert, let's call it unusual processes or logins. 

now, I've created a search - in which I find the specific events that are considered suspicious, and I save it as a sheduled search and as an action I write it into the triggered alerts. the timeframe is -20m@m till -5m@m and the cron job is for every 5 minutes. now I see that there is an issue in that case, because if I cron the job every 5 minutes, given the look back timeframe, I'm getting at least 3 of the same events triggered as an alert. 

now my question is, is there an option/way to trigger based on whether or not an event already occured ? so basically that the search looks - did I trigger that event before already? if yes, then don't write it in the triggered alerts, otherwise, write it in  the triggered alerts. 

every help is appreciated

[meetmshah]

Hello @avoelk, Alert throttling should help here? Doc - https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts. If not alert throttling, you can also dump the results in a lookup / summary index and exclude the events in the consuquitive runs.

Please let me know if any questions.

Please hit Karma, if this helps!

[richgalloway]

That's called throttling.  When you edit the alert, click the "Throttle" box and specify how long alerts should be silenced.  Splunk will not send an alert for the same conditions during the throttle period.

[gcusello]

Hi @avoelk ,

you should write triggered alerts in a summary index or in a lookup and then filter results based on this index.

Ciao.

Giuseppe