Alerting

Logevent alert : Why does trigger_timeHMS appears several times?

splunkreal
Motivator

Hello guys,

I use $trigger_timeHMS$ in logevent (triggering for each result) and I can see $trigger_timeHMS$ appears several times per tens results.

I use this token to save reporting date in raw data :

ex : schedule at 13:00 =

2019-03-20 13:00:32 19 events
2019-03-20 13:00:33 29 events
2019-03-20 13:00:34 29 events
2019-03-20 13:00:35 8 events

There is no duplicate result.

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...