Options to snooze Splunk Alert

arunsubram · ‎11-23-2017

Hi, Wanted to check on solutions to snooze Splunk Alert. When a service is down, we disable the Splunk Alert till it is being worked. Sometime, the engineer forgets to enable to Alert back. is there a Add on or option in splunk to snooze for 1 hour or so and turn the Alert back ON. Kindly suggest.

kamlesh_vaghela · ‎11-23-2017

Hi @arunsubram,

Instead of enabling/disable Alerts I suggest to set Throttle in alerts. In your case, you can Throttle alerts for 60 min. Please refer below link for more information.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Alert/ThrottleAlerts

Thanks

Options to snooze Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Conversation

Options to snooze Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station