Is throttling based on the trigger time or on event time

[yanhu]

I would like to confirm what TIME the throttling window duration is using. is it based on the trigger time or on event time. Also, what is the different than throttling 1 day or 24 hours.

We have a correlation search, with real-time scheduling.

Trigger alert when number of results is greater than 0; Throttling window duration is set to 1 day. 

Search is scheduled to run at 15 * * * *  for time range -5m@m to -65m@m

The first notable was triggered on Aug 4 at 16:17, which reported the event occurred at 15:36 on Aug 4.

The second event occurred on Aug 5 at 16:08, which didn't trigger the notable.

When i reran the SPL manually for the time range between 15:10 - 16:10, the search returned result.

What would be the reason of not seeing alert? Throttling? or event not received in splunk when search was running?

Thanks!

[thambisetty]

Its based on triggered time and field set you choose while enabling throttling while creating the correlation rule.

[richgalloway · Accepted solution]

Throttling is based on trigger time.
AFAIK, '1d' and '24h' are the same, but there may be a subtle difference.
The second alert probably didn't appear because of throttling.

[isoutamo]

You could found your executed alert searches by the next query if you haven't MC installed.

index=_audit sourcetype=audittrail action=search user=<user which are running your alert> savedsearch_name=<your alerts name>

And if you have MC then just looking:

Settings -> MC -> Search -> Scheduler Activity (instance, deployment based on your environment)

There you can see e.g. skipped searches and reason for those.

r. Ismo