Splunk Alert same results

[Aresndiz]

Does anyone know if there is a way to suppress the sending of alerts during a certain time interval if the result is the same as the previous trigger, and if the result changes, it should trigger regardless of any suppression or only trigger when there is a new event that causes it to trigger?

[sainag_splunk]

@Aresndiz Checkout https://docs.splunk.com/Documentation/Splunk/9.3.2/Alert/ThrottleAlerts
.You can control alert throttling behavior using these settings in your saved search:

alert.suppress = 1
alert.suppress.period = <time-value>

For your specific case of wanting to suppress similar results but trigger on changes, you can also use:

alert.suppress.fields = <comma-separated-field-list>

This tells Splunk to only suppress alerts if the specified fields contain the same values. If the values change, a new alert will trigger even if it's within the suppression period. This gives you the balance of avoiding duplicate notifications while still catching important changes.

If this helps, Please Upvote.

[Aresndiz]

Where is this used? In my search SLP or in the config alerts?

alert.suppress.fields = <comma-separated-field-list>