Alerting

correlation rule is configured as time range -65m to -5m and cron schedule is every 5 minutes then why will there not be duplicate alerts for every 5 min?

lalitha101
New Member

correlation rule is configured as time range -65m to -5m and cron schedule is every 5 minutes then why will there not be duplicate alerts for every 5 min?

0 Karma

woodcock
Esteemed Legend

If you have accurately (completely) documented your configuration then you almost certainly will see duplicates.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without any context I'm guessing there's a throttling window of 60 minutes defined on some key field to suppress repeat events.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!