If a field's count drops to a certain number below the alert condition threshold after being triggered, will the throttle timer reset?

Path Finder

I am configuring throttling for a Splunk alert. I have it set to generate an alert for each event, and am throttling for 8hrs on a particular field.

How sophisticated is Splunk's Alert Throttling?

For example:

An alert is generated for the field queuename when count > 0. Queue1's count rises to 1, and an alert is generated. Throttling says another alert for queuename Queue1 will not be generated for 8 hours.

However, what if Queue1's count drops to zero after 1 hour. An hour after that (2 hours total), it rises to 3000. Will an alert be generated? Or will the throttle applied earlier still apply?

In essence, I guess I'm asking if the throttle timer is reset if a field comes out of alarm.

0 Karma

New Member

Anyone !! is there a way to generate an alert during its throttle period if the transaction failure is above than the result of first alert generated????

0 Karma

Splunk Employee
Splunk Employee

TTBOMK, there is no concept on an 'alert reset condition', or 'a field coming out of alarm', so in your use case, the alert will not be generated for 8 hours after the last time it triggered, even if the alerting condition no longer exists.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...