Alerting

If a field's count drops to a certain number below the alert condition threshold after being triggered, will the throttle timer reset?

danielrusso1
Path Finder

I am configuring throttling for a Splunk alert. I have it set to generate an alert for each event, and am throttling for 8hrs on a particular field.

How sophisticated is Splunk's Alert Throttling?

For example:

An alert is generated for the field queuename when count > 0. Queue1's count rises to 1, and an alert is generated. Throttling says another alert for queuename Queue1 will not be generated for 8 hours.

However, what if Queue1's count drops to zero after 1 hour. An hour after that (2 hours total), it rises to 3000. Will an alert be generated? Or will the throttle applied earlier still apply?

In essence, I guess I'm asking if the throttle timer is reset if a field comes out of alarm.

0 Karma

tarunchandra_re
New Member

Anyone !! is there a way to generate an alert during its throttle period if the transaction failure is above than the result of first alert generated????

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

TTBOMK, there is no concept on an 'alert reset condition', or 'a field coming out of alarm', so in your use case, the alert will not be generated for 8 hours after the last time it triggered, even if the alerting condition no longer exists.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...