Options to snooze Splunk Alert

arunsubram · ‎11-23-2017

Hi, Wanted to check on solutions to snooze Splunk Alert. When a service is down, we disable the Splunk Alert till it is being worked. Sometime, the engineer forgets to enable to Alert back. is there a Add on or option in splunk to snooze for 1 hour or so and turn the Alert back ON. Kindly suggest.

kamlesh_vaghela · ‎11-23-2017

Hi @arunsubram,

Instead of enabling/disable Alerts I suggest to set Throttle in alerts. In your case, you can Throttle alerts for 60 min. Please refer below link for more information.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Alert/ThrottleAlerts

Thanks

Options to snooze Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Options to snooze Splunk Alert

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...