Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- help with alert throttling needed
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have the alert that produces the table as an output, let us say that it looks as follows:
SYSSID, HOST, EMAIL
BWP, h1, email_list_1
BWP, h1, email_list_2
Now, I would like that two separate alerts get triggered, one for the row1 and second for the row2, the idea is that they are then sent to separate email recipients.
Now, what I did what to use throttling per result with the following settings for "Suppress results containing field value
":
$result.SYSSID$, $result.HOST$, $result.EMAIL$
What I would expect from that is that I get two separate alerts triggered (per result) and they both get suspended for the given time (15 min). Unfortunately I am not able to get it working. What happens is that only the first row is "seen" when processing the alert and correspondingly I get only one alert triggered, which is wrong.
Could you please help?
Kind Regards,
Kamil
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try entering direct fieldname in "Suppress results containing field value" box-
SYSSID,HOST,EMAIL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try entering direct fieldname in "Suppress results containing field value" box-
SYSSID,HOST,EMAIL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, it worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am converting my comment to an answer please accept and upvote if it helps. 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
