Reporting

How to enable throttle for a Scheduled Report ?

zacksoft_wf
Contributor

I have a scheduled report that runs once every 12 hour. But once it runs , it generates same email alerts multiple times during the scheduled time,
Is there any way to compress / throttle to just one report/email ?

| tstats min(_time) as first_time max(_time) as last_time values(sourcetype) where TERM(121.121.1.165) OR TERM(876.234.11.214) OR TERM(192.176.30.196) by index
| convert ctime(first_time) ctime(last_time)
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zacksoft_wf,

Check the actions of your alert: probably a scheduled search doesn't need also an eMail notification.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...