Alerting

Throttle Alert per result for multiple unique values

willcwhite
Explorer

I created an alert that outputs multiple application names when the alert query conditions are met. I want to receive a separate alert for each application and throttle each one for an hour. I tried using $result.application$ as the "suppress results containing field value" input, but that prevented any alerts coming in after the first one was created. Is there any way to throttle alerts for each specific value without having to manually type in each one, as there are hundreds.

Thanks

0 Karma

anmolpatel
Builder

In savedsearches.conf

[alert_name]
action.email = 1
action.email.to = test@test.com
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
counttype = number of events
cron_schedule = 1 * * * *
dispatch.earliest_time = -1h@-1m
dispatch.latest_time = now

This will email the result as a table and should suppress for next 1 hour until next search is executed

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...