All Apps and Add-ons

Slack Notification Alert: Trigger - Prevent notifications if the status is the same

CPOUYE
New Member

Dear all,
We wanted to stop notification when result of alert stay same.

We launch an alert each 4 minutes on specific scope

Target :
- alert without result (no mail)
- alert with result > 0 (first time (send mail)
- alert with more result than before (send mail)
- alert with result = result before (no mail)

At this moment we tested
greater than (and we receive mail each 4 min whil result isn't 0
drop by 1 (and we receive mail when result = 0)

Thanks for your help
Clement - Support to financial company

0 Karma

harsmarvania57
Ultra Champion

Hi @CPOUYE,

You can use Throttling while creating Scheduled Alert but this will trigger multiple alert for multiple output in single scheduled search window.

Please follow below steps while creating scheduled search (Alert).
1.) In Trigger Conditions, select Trigger for Each Result
2.) Then tick the Throttle.
3.) In Suppress results containing field value, please provide field name. If you are counting using stats command then give count in this textbox.
4.) Suppress triggering for -> Here you can give time period till that splunk will not trigger an alert if count will be same (I am assuming that you are using stats count in your query).

I hope this helps.

Thanks,
Harshil

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...