Splunk Enterprise Security

When setting up an alert with a "saved search," why am I getting duplicate alerts for the same event with different event_id?

New Member

I have set up an alert using a "Saved search" in Splunk Enterprise Security. I am throttling alerts for an hour when src, dest, and threat identifier are same. For the most part, this alert is working fine. However, every now and then I see anomalies like the ones below:

  1. Some time, I see that same alerts are fired twice in quick succession.

  2. Other times, I see the same alert fired a second time before Hour limit of throttling is over (e.g. second alert after 30-40 mins of first alert).

The event ID and event hash are different for different alerts. It seems 'notable' macro is assigning a different event_id to the same event. Now, I am wondering how is that possible and how do I fix this?

0 Karma

Path Finder

What are your settings for Time Range? Specifically, earliest time, latest time, cron schedule, and schedule window?

It sounds like your saved search is running twice over the same data and generating different notable events for the same data. Throttling applies to each occurrence of the saved search, but has no affect on subsequent runs of that saved search. It could be something else but that's what I'd look at first.

0 Karma

New Member

earliest time : -10m@m,
latest time: @m,
cron Schedule : Every 10 mins (*/10 * * * *) - This comment page has modified my cron impression to this.
schedule window (I think, we are referring to Time window here) : In my opinion, it should not have any impact as my search has earliest and latest time, however, I have set it as "Last 15 mins".
Search is set to run on cron schedule.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...