realtime alerts - exactly one alert per event ?

[elenzil]

i would like to set up a realtime alert which fires exactly once per matching search.
throttling is close to this, but not exactly.
eg, if i have two events in a sub-second window,
i want two alerts.

in the meantime, even with throttling, i'm finding myself getting > 1 alert per event.

is there something i'm missing ?

tia,
orion

[Takajian · Accepted solution]

I do not think real time alert function is able to fire alert per each events. I heard next version 4.3 will have some improvment of real time alert functions.

[AditiKulkarni]

Can we achieve this condition in Splunk 6.1.5?

[elenzil]

😕

thanks Takajian. i guess i'll approximate it w/ threshholds.