Hello All,
I am working on a unique request and was wondering if its possible.
The request is to run an alert every hour and if a user appears in the alert, it should ignore the same user for one week.
Need your help if it can be configured.
Thanks in advance,
In Alerts for Splunk Admins, https://splunkbase.splunk.com/app/3796/ or https://github.com/gjanders/SplunkAdmins
I have examples such as SearchHeadLevel - Users exceeding the disk quota introspection, where I use a lookup file to stop emailing users for a week. A separate report cleans up the lookup
That's another alternative...
Hi
your alert need to return all users by it’s own row if they are alerted. Then in alert dialog select alert per results and needed throttle time for that.
https://docs.splunk.com/Documentation/Splunk/8.2.0/Alert/AlertTriggerConditions
r. Ismo
Thanks for the response, I am going to test it further.