Splunk Dev

How can I delete the following duplicate alerts?

lifekis
Explorer
index=av source=avRawvirusAlertLog
| table CLIENTTIME, CLIENTIPADDR, NAME, PATH, STATUS_msg, SCANTYPE_msg

edit alert
alert type: reserved
time range: Last 60 minutes
cron: /30***
trigger: result count > 0
trigger: once

when I receive Splunk alert, always duplicate twice..

How can I solve it?

Tags (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You're getting duplicate alerts because of the way you setup your cron schedule and the timerange. Your timerange is saying look back the last 60 minutes and run the alert every 30 minutes. Maybe an example will clear this up

Say its 6pm and your alert fires and checks if the count is greater than 0. The alert will look from 5pm - 6pm.. At 5:59pm you did have a result count greater than 0, so this triggers an alert action. Then your alert fires again at 6:30pm and looks over the timerange 5:30pm - 6:30pm and sees the exact same condition that the first alert fired (i.e. at 5:59pm). You need to either decrease your timerange to have it match the cron expression or increase your cron expression to match the timerange

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You're getting duplicate alerts because of the way you setup your cron schedule and the timerange. Your timerange is saying look back the last 60 minutes and run the alert every 30 minutes. Maybe an example will clear this up

Say its 6pm and your alert fires and checks if the count is greater than 0. The alert will look from 5pm - 6pm.. At 5:59pm you did have a result count greater than 0, so this triggers an alert action. Then your alert fires again at 6:30pm and looks over the timerange 5:30pm - 6:30pm and sees the exact same condition that the first alert fired (i.e. at 5:59pm). You need to either decrease your timerange to have it match the cron expression or increase your cron expression to match the timerange

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

First I would ask if you are getting multiple results in your search. Next I would ask if you are triggering the alert Once, or for each result. If for each result, are you seeing duplicate values for the results. For example if you want an alert for each CLIENTIPADDR, and you possible have 2 rows in your table with the same value for CLIENTIPADDR. If so, you could use dedup in your search or something. Have you tried throttling in the alert config?

0 Karma

osakachan
Communicator

What are you receiving? An e-mail or other thing?

Can you add information about time of alerts and logs who trigger the alert?

0 Karma

lifekis
Explorer

I got an email.
receive the same message 30 minutes after receiving the first warning message.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should read my answer below if you want to fix your issue...

0 Karma

whrg
Motivator

Your cron expression looks weird. If you meant every 30 minutes then type:

*/30 * * * *

EDIT: Never mind. I can see this is a formatting issue on splunkanswers when not using code blocks.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...