Alerting

Throttle alerts based on field value

ckillg
Path Finder

Is it possible to throttle alerts by field value?

For example: I want to alert when the value of field "action" is "delete" and throttle any subsequent results for 10 minutes unless the value of the field "username" changes.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, change the Alert mode to Once per result which will enable a field called Per result throttling fields which is where you put username.

View solution in original post

woodcock
Esteemed Legend

Yes, change the Alert mode to Once per result which will enable a field called Per result throttling fields which is where you put username.

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...