Alerting

help with alert throttling needed

damucka
Builder

Hello,

I have the alert that produces the table as an output, let us say that it looks as follows:

SYSSID, HOST, EMAIL
BWP, h1, email_list_1
BWP, h1, email_list_2

Now, I would like that two separate alerts get triggered, one for the row1 and second for the row2, the idea is that they are then sent to separate email recipients.
Now, what I did what to use throttling per result with the following settings for "Suppress results containing field value
":
$result.SYSSID$, $result.HOST$, $result.EMAIL$

What I would expect from that is that I get two separate alerts triggered (per result) and they both get suspended for the given time (15 min). Unfortunately I am not able to get it working. What happens is that only the first row is "seen" when processing the alert and correspondingly I get only one alert triggered, which is wrong.

Could you please help?

Kind Regards,
Kamil

Labels (3)
0 Karma
1 Solution

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL

View solution in original post

0 Karma

493669
Super Champion

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL
0 Karma

damucka
Builder

Thank you, it worked.

0 Karma

493669
Super Champion

I am converting my comment to an answer please accept and upvote if it helps. 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...