Alerting

Throttle alerts based on field value

ckillg
Path Finder

Is it possible to throttle alerts by field value?

For example: I want to alert when the value of field "action" is "delete" and throttle any subsequent results for 10 minutes unless the value of the field "username" changes.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, change the Alert mode to Once per result which will enable a field called Per result throttling fields which is where you put username.

View solution in original post

woodcock
Esteemed Legend

Yes, change the Alert mode to Once per result which will enable a field called Per result throttling fields which is where you put username.

Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...