Alert mode Once per search

[jaho_splunk]

The Zenoss add on is sending events for each result found when it has been set to alert Once Per Search. Is there a a fix for this ?

[cbright]

I have the same issue and need a fix for this. Events are bundled as email and report but if we turn on Zenoss add-on script we get one event for each match. We have a SH cluster with index clustering and it happens with any alert query on any SH. Please let me know if you got an answer or if anyone else can answer.

[jkat54]

Which search is doing this? All of them or just one?

What is the architecture we are dealing with here? Search head cluster, single search head with indexer(s), or standalone (1 server).

[jaho_splunk]

I have two searches configured to send to Zenoss with alert mode of once per search and both are sending an event for every result. Search Cluster (4) environment with four indexers.