Slack Notification Alert: Trigger - Prevent notifications if the status is the same

[CPOUYE]

Dear all,
We wanted to stop notification when result of alert stay same.

We launch an alert each 4 minutes on specific scope

Target :
- alert without result (no mail)
- alert with result > 0 (first time (send mail)
- alert with more result than before (send mail)
- alert with result = result before (no mail)

At this moment we tested
greater than (and we receive mail each 4 min whil result isn't 0
drop by 1 (and we receive mail when result = 0)

Thanks for your help
Clement - Support to financial company

[harsmarvania57]

Hi @CPOUYE,

You can use Throttling while creating Scheduled Alert but this will trigger multiple alert for multiple output in single scheduled search window.

Please follow below steps while creating scheduled search (Alert).
1.) In Trigger Conditions, select Trigger for Each Result
2.) Then tick the Throttle.
3.) In Suppress results containing field value, please provide field name. If you are counting using stats command then give count in this textbox.
4.) Suppress triggering for -> Here you can give time period till that splunk will not trigger an alert if count will be same (I am assuming that you are using stats count in your query).

I hope this helps.

Thanks,
Harshil