Alerting

Splunk Alert Throttle - Logically AND/OR?

andrewjhill
Path Finder

When adding multiple fields in the "Suppress results containing field value" - is that logically an AND or an OR? This could produce two entirely different outcomes. I would ideally like to suppress when both fields are found in subsequent alerts, however, it seems like this might say for any future alert that contains either field, don't alert again. Some clarity would be nice! (The documentation doesn't touch on this)

alt text

1 Solution

richgalloway
SplunkTrust
SplunkTrust

I submitted doc feedback for you earlier today and here is the response I received.

The “Per-result” option depends on the value of fields you specify. It works as an AND. So, for example:
If you have two fields, say “userID” and “URL,” specified in your search, and the search you run returns events where logins failed, say the value is “FAILED”. If you specify “userID” and “URL” in your throttle, an alert will not trigger if those two field values are returned as “FAILED”. It will alert if only one field returns as “FAILED” but the other returns a different value.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I submitted doc feedback for you earlier today and here is the response I received.

The “Per-result” option depends on the value of fields you specify. It works as an AND. So, for example:
If you have two fields, say “userID” and “URL,” specified in your search, and the search you run returns events where logins failed, say the value is “FAILED”. If you specify “userID” and “URL” in your throttle, an alert will not trigger if those two field values are returned as “FAILED”. It will alert if only one field returns as “FAILED” but the other returns a different value.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

If the documentation is ever unclear about something, submit feedback at the bottom of the on-line documentation page. Splunk's docs team is excellent about updating the documentation in response to user feedback.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...