Splunk alert to ignore user for a week

[spodda01da]

Hello All,

I am working on a unique request and was wondering if its possible.

The request is to run an alert every hour and if a user appears in the alert, it should ignore the same user for one week.

Need your help if it can be configured.

Thanks in advance,

[gjanders]

In Alerts for Splunk Admins, https://splunkbase.splunk.com/app/3796/ or https://github.com/gjanders/SplunkAdmins

I have examples such as SearchHeadLevel - Users exceeding the disk quota introspection,  where I use a lookup file to stop emailing users for a week. A separate report cleans up the lookup 

That's another alternative...

[isoutamo]

Hi

your alert need to return all users by it’s own row if they are alerted. Then in alert dialog select alert per results and needed throttle time for that.

https://docs.splunk.com/Documentation/Splunk/8.2.0/Alert/AlertTriggerConditions

r. Ismo

[spodda01da]

Thanks for the response, I am going to test it further.