How to write throttle alert?

[nanachu]

Hi,all

I have a question about how to write throttle alert.

I want to specify two fields.

But, I can not find document.

my field is "name" and "region".

I think name AND region OR name, region

If you know that, please help me.

Thank you.

[snigdhasaxena]

@nanachu change trigger alert when to "once per result" and this will enable field "Per result throttling field" and there you can put your field value pairs for throttling

[kamlesh_vaghela · Accepted solution]

@nanachu

I have a workaround. Can you please update your search by adding a new field?

YOUR_SEARCH | eval throttle_field = name."_".region

Use throttle_field filed as suppress results containing field value.

Can you please try this?

[kamlesh_vaghela]

@nanachu

Does this answer solved your issue?? If yes then can you please accept this answer to close this question?? If No please let us know so we can help you further on it.

Happy Splunking

[nanachu]

Thank you for helping me.

I can understand I have to make new field.
But, I have a question.
What is it means (."_".)?
it means instead of AND?

[jawaharas]

It's just a character used concatenation of two strings. You can use any other letters or symbols. It's just for better readability.

[nanachu]

Thank you for helping me.

I'm sorry but I don't understand much.
Could you help me?

I want to suppress name AND region.
for example,
name=A ,region=singapore

if I use

|eval throttle_field = name." ".region

I thought that is Asingapore.

I want to suppress the same name and region.
(in this case, A and singapore is trigger)

Can I use ."_".?

If my English is bad, I'm really sorry.

Regards,

[jawaharas]

@nanachu You are doing good.

 <YOUR_SEARCH> | eval throttle_field = name."_".region

It's better to use underscore, rather than a space for this purpose. After you modifying your query as mentioned above, just add the new field name - throttle_field in the
'Suppress results containing field value' input box in the 'Create Alert' configuration.

[nanachu]

Thank you for your kind answer.

I can understand!

Thank you.

[kamlesh_vaghela]

@nanachu

Yes, you can use _.

As per your requirement throttling should be on name=A and region=singapore.

Means if any events arrive with the same field value then it should only consider if the duration between last occurrence and present occurrence is more than the defined throttle period.

here we have provided throttle_field which is representing as throttling field with required values A_singapore.

[nanachu]

Thank you for your kind answer.
I understand so much.

Thank you.