Why does some SNMP traps trigger multiple alerts within a small period of time?

[adam_dixon95]

Hi,

So I'm currently receiving SNMP traps in Splunk and have successfully set up Email alerts for these.

The only issue is - I have some SNMP traps that trigger multiple alerts within a small period of time, which are just interface flaps.

I usually receive 6 UP/DOWN traps/alerts within roughly 1 minute. This is regular activity

I would like to suppress these alerts so that I'm only alerted once, or just receive 1 up alert and 1 down alert.

These traps come in the same kind of format in Splunk.

Any advice on this kind of alert suppression would be helpful.

[deepashri_123 · Accepted solution]

Hey adam_dixon95,

You can use throttling to supress alerts:
Refer this accepted answer and the doc below:
https://answers.splunk.com/answers/143392/is-there-a-way-to-suppress-an-alert-based-upon-fields.html
https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts

Let me know if this helps!!