Dashboards & Visualizations

How to remove duplicate Error Messages in splunk

aditsss
Motivator

Hi Everyone,

I have one requirement.

I have created one Error message Alert as below:

index=abc ns=xyz CASE(ERROR)|rex field=_raw "ERROR(?<Error_Message>.*)" |eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")| cluster showcount=t t=0.3|table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns |dedup Error_Message| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name,cluster_count as Count

But from this I am duplicate alert.

Entire Data is coming same except count.

Can someone guide me what should I remove from query.

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

have you a duplicated alert because:

  • you configured this alert in more than one Search Head,
  • the error condition cotinue to be valid also after the first alert?

In the first case, the only way is to have a Search Head Cluster that manages the alert's execution.

In the second case, you can disable the alert after an occurrance for a defined time.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...