Alerting

help with alert throttling needed

damucka
Contributor

Hello,

I have the alert that produces the table as an output, let us say that it looks as follows:

SYSSID, HOST, EMAIL
BWP, h1, email_list_1
BWP, h1, email_list_2

Now, I would like that two separate alerts get triggered, one for the row1 and second for the row2, the idea is that they are then sent to separate email recipients.
Now, what I did what to use throttling per result with the following settings for "Suppress results containing field value
":
$result.SYSSID$, $result.HOST$, $result.EMAIL$

What I would expect from that is that I get two separate alerts triggered (per result) and they both get suspended for the given time (15 min). Unfortunately I am not able to get it working. What happens is that only the first row is "seen" when processing the alert and correspondingly I get only one alert triggered, which is wrong.

Could you please help?

Kind Regards,
Kamil

Labels (3)
0 Karma
1 Solution

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL

View solution in original post

0 Karma

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL

View solution in original post

0 Karma

damucka
Contributor

Thank you, it worked.

0 Karma

493669
Super Champion

I am converting my comment to an answer please accept and upvote if it helps. 🙂

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.