Alerting

Trigger Alert Only Once per host

kalpeshpadhariy
New Member

Hi Team,

In my use-case, we are querying multiple hosts in a single query. Here we're using custom trigger conditions to trigger an alert. (e.g "search health='Unhealthy'")

The schedule is every 7 mins (Cron: */7 * * * *), for Time Range of the last 10 mins.

We need alert triggered only once per host till the alert is not cleared. (Unless another host is alerting. Not same host)

The purpose to do this is an automatic ticket generation. (If repetitive alerts are getting triggered, that will result in duplicate tickets generation)

If we use Throttle condition here, let's say throttle alerts for 1 hour, during that 1 hour time, any other host may start alerting, I won't be able to receive alert for that host as well.

Please suggest the best way to do this asap...

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
You should select alerts per result not once and then select host field as result. See details from alerting manual if needed.
r. Ismo
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you change your query so it only counts unhealthy hosts if they weren't unhealthy in the previous time period? This assumes that the hosts that are unhealthy will continue to show up in your search until they are made healthy - consider using autoregress as one possible way of doing this

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...