Alerting

help with alert throttling needed

damucka
Builder

Hello,

I have the alert that produces the table as an output, let us say that it looks as follows:

SYSSID, HOST, EMAIL
BWP, h1, email_list_1
BWP, h1, email_list_2

Now, I would like that two separate alerts get triggered, one for the row1 and second for the row2, the idea is that they are then sent to separate email recipients.
Now, what I did what to use throttling per result with the following settings for "Suppress results containing field value
":
$result.SYSSID$, $result.HOST$, $result.EMAIL$

What I would expect from that is that I get two separate alerts triggered (per result) and they both get suspended for the given time (15 min). Unfortunately I am not able to get it working. What happens is that only the first row is "seen" when processing the alert and correspondingly I get only one alert triggered, which is wrong.

Could you please help?

Kind Regards,
Kamil

Labels (3)
0 Karma
1 Solution

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL

View solution in original post

0 Karma

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL
0 Karma

damucka
Builder

Thank you, it worked.

0 Karma

493669
Super Champion

I am converting my comment to an answer please accept and upvote if it helps. 🙂

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...