Rolling time period question

[spm807]

I would like to do a search of a rolling 60-minute period, looking for 3 or more occurrences in that period. I set up a Splunk alert to run every 15 minutes, looking back 1 hour, which works, but then I get multiple alerts for the same 3 events, as they still are in the 60-minute look back period for multiple runs, which happen every 15 minutes. How can I set this up (or code it) so it only reports the 3 occurrences in the previous 60 minutes once?

[spm807]

The reason the time period of the execution frequency is not the same as the execution frequency is so we don't miss a 3-event occurrence that straddles two periods. If we ran it once every 60 minutes looking back 60 minutes, we wouldn't get duplicates, but we'd also miss the case in which one event occurred just before the last 60 minutes, and 2 occurred just after the start of the period. I will investigate stats count BY host, thank you.

[gcusello]

Hi @spm807 ,

as I said, try using throttling in your alerts, it's the solution to your problem.

Ciao.

Giuseppe

[gcusello]

Hi @spm807 ,

usually the time period is the same of the execution frequency just to avoid duplicates.

Anyway, you could copnfigure throttling to avoid that the same values fire the alert.

Throttling id configured by the fields in your alert.

In other words, if you have a stats count BY host, you can configure the throttling by host, so if the same host will b e fired the alert will not be triggered.

Ciao.

Giuseppe