only alert on new events

[aledav]

Hi everyone,

We recently set up Splunk for testing. One of the features I'm most interested in right now is the "Alert" functionality.

I have created a alter that runs every day at 06:00. The alert find the events I'm searching for and creates a alert. The only issues is that every new alert also includes events that are older than 24 Hours. I would like to only alter on events that are newer than 24 hours.

Is this possible?

/ Alexander

[Ayn · Accepted solution]

Sure. Define the timerange for the search you're using to be last 24 hours. Have a look at the section "Start by defining and saving a search" in this section of the docs: http://docs.splunk.com/Documentation/Splunk/latest/User/SchedulingSavedSearches