Splunk alert for multiple time?

Monitoring Splunk

Thanks in advance.

We have scenario that we need to send alerts multiple times .

1. Lagging      E.g Lets put Threshold time : 1 Hour
20/02 10:00 AM NZT : Lagging encountered after 1 Hour threshold -> Alert#1 via email with subject : Total lag time
20/02 11:00 AM NZT : Lagging still occur -> Alert#2 via email with subject : Total lag time   2 hour (Accumulated lagging hour) + Create Incidents in ServiceNow
      20/02 13:00 PM NZT : Lagging encountered after 1 Hour threshold -> Alert#3 via email with subject : Total lag time
20/02 14:00 PM NZT : Lagging encountered after 1 Hour threshold -> Alert#4 via email with subject : Total lag time ---Got fixed

Get Updates on the Splunk Community!

Splunk alert for multiple time?

scheduler activity

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Splunk alert for multiple time?

scheduler activity

splunk-assist

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future