All Apps and Add-ons

Alert Manager - auto resolve if "append incident with the same title" is enabled

djluke
Path Finder

Hi Splunkers,
I'm here again asking for help with the alert manager app.
I'm trying the "auto-resolve" feature combined with "append incident with the same title".

I would like that all incidents with new appended events to be automatically closed at time "last_event + ttl"

What I'm seeing now is an automatic closure at time "open time + ttl" even if there are new events for the same incident.

Here below a simple example:
Auto-close = enabled
Append new incidents = enabled

Search = my search
TTL = 11m
Incident creation time = 13:00:00 
Appended events time = 13:05:00 , 13:10:00

Auto close time = 13:00:00 + 11m = 13:11:00
Desidered auto close time = 13:10:00 + 11m = 13:21:00


Thanks in advance for your support.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...