All Apps and Add-ons
Highlighted

Alert mode Once per search

Engager

The Zenoss add on is sending events for each result found when it has been set to alert Once Per Search. Is there a a fix for this ?

0 Karma
Highlighted

Re: Alert mode Once per search

SplunkTrust
SplunkTrust

Which search is doing this? All of them or just one?

What is the architecture we are dealing with here? Search head cluster, single search head with indexer(s), or standalone (1 server).

0 Karma
Highlighted

Re: Alert mode Once per search

Engager

I have two searches configured to send to Zenoss with alert mode of once per search and both are sending an event for every result. Search Cluster (4) environment with four indexers.

0 Karma
Highlighted

Re: Alert mode Once per search

Explorer

I have the same issue and need a fix for this. Events are bundled as email and report but if we turn on Zenoss add-on script we get one event for each match. We have a SH cluster with index clustering and it happens with any alert query on any SH. Please let me know if you got an answer or if anyone else can answer.

0 Karma