throttling fields

[Michael]

I've used throttling in the past, but this feature must be new from one of the updates. It was simple before "don't trigger again after x time", period. But now it's asking for "Per result throttling fields" -- and I have not idea what that's asking for. Searching for it here results in tons of information on how to set alerts, and throttling, but doesn't say what this is...and it's apparently important as it won't let me use throttling without it!

I have a simple search:
source="/var/log/processes.log" | stats count as processes.log | search count < 10

My alert will trigger if this is true (number of events is greater than one). I want to run this every hour, but if a process is down, I don't want to come in on a Monday morning to 48 emails -- one a day will do. So I set the throttling to not trigger again for 24 hours. BUT, I don't know what a "throttling field" is.

Please enlighten!

[linu1988]

I am not sure about the search . But processes.log will become your throttling field name. As once you receive it you don't want to get an alert until next 24 horus.

[martin_mueller]

I think you can specify a dummy field name - that will always be null. As a result, it won't trigger again for that time.

The idea is for example to have a host field and only be silent for hosts that have triggered in the past day but still throw an alert for a new host.

[martin_mueller]

Has your issue been solved?

[Michael]

Thank you! I tried that before and it didn't work -- but after simplifying the alert to a simple check for the number of events being less than 10 (and taking out the "stats count..." and "search count..." cruft) it seems to be working dandy...