Alerting

realtime alerts - exactly one alert per event ?

elenzil
Path Finder

i would like to set up a realtime alert which fires exactly once per matching search.
throttling is close to this, but not exactly.
eg, if i have two events in a sub-second window,
i want two alerts.

in the meantime, even with throttling, i'm finding myself getting > 1 alert per event.

is there something i'm missing ?

tia,
orion

Tags (3)
0 Karma
1 Solution

Takajian
Builder

I do not think real time alert function is able to fire alert per each events. I heard next version 4.3 will have some improvment of real time alert functions.

View solution in original post

0 Karma

Takajian
Builder

I do not think real time alert function is able to fire alert per each events. I heard next version 4.3 will have some improvment of real time alert functions.

0 Karma

AditiKulkarni
New Member

Can we achieve this condition in Splunk 6.1.5?

0 Karma

elenzil
Path Finder

😕

thanks Takajian. i guess i'll approximate it w/ threshholds.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...