Alerting

Logevent alert : Why does trigger_timeHMS appears several times?

splunkreal
Motivator

Hello guys,

I use $trigger_timeHMS$ in logevent (triggering for each result) and I can see $trigger_timeHMS$ appears several times per tens results.

I use this token to save reporting date in raw data :

ex : schedule at 13:00 =

2019-03-20 13:00:32 19 events
2019-03-20 13:00:33 29 events
2019-03-20 13:00:34 29 events
2019-03-20 13:00:35 8 events

There is no duplicate result.

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...