Throttle Alert per result for multiple unique values


I created an alert that outputs multiple application names when the alert query conditions are met. I want to receive a separate alert for each application and throttle each one for an hour. I tried using $result.application$ as the "suppress results containing field value" input, but that prevented any alerts coming in after the first one was created. Is there any way to throttle alerts for each specific value without having to manually type in each one, as there are hundreds.


0 Karma


In savedsearches.conf

[alert_name] = 1 =
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
counttype = number of events
cron_schedule = 1 * * * *
dispatch.earliest_time = -1h@-1m
dispatch.latest_time = now

This will email the result as a table and should suppress for next 1 hour until next search is executed

0 Karma

Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...