Alerting

Splunk Alert: Are actions performed by a single or multiple thread?

morethanyell
Builder

We have an alert which sends email for every result. In the query, there is a sorting process which is important in the sequence of our email notifications. Say our SPL is like this:

...
| sort Hierarchy
| table Hierarchy, Field2, Field3

For example, the query above results to a 5x3 table (5 rows) .:

Hierarchy Field2 Field3
1         aaa    zzz 
2         bbb    yyy
3         ccc    xxx
4         ddd    www
5         eee    uuu

What we notice is our MS Outlook receives the 5 emails not in order. It's very important for our stakeholders to receive these email notifications in order.

Is there some kind of a documentation (which I can't find, that's why I'm asking here) that will confirm that the reason for this is because Splunk performs the send email function asynchronously or in multiple threads instead of synchronous or single thread? Or are there other explanations?

0 Karma

morethanyell
Builder

Tumbleweed

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...