Alerting

Throttle Alert per result for multiple unique values

willcwhite
Explorer

I created an alert that outputs multiple application names when the alert query conditions are met. I want to receive a separate alert for each application and throttle each one for an hour. I tried using $result.application$ as the "suppress results containing field value" input, but that prevented any alerts coming in after the first one was created. Is there any way to throttle alerts for each specific value without having to manually type in each one, as there are hundreds.

Thanks

0 Karma

anmolpatel
Builder

In savedsearches.conf

[alert_name]
action.email = 1
action.email.to = test@test.com
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
counttype = number of events
cron_schedule = 1 * * * *
dispatch.earliest_time = -1h@-1m
dispatch.latest_time = now

This will email the result as a table and should suppress for next 1 hour until next search is executed

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...