Splunk IT Service Intelligence

Send email only once after an episode is open for a period of time

damickel
Explorer

I'm creating a number of correlation searches, and I'd like to be able to send an email ONLY when an episode has been open for more then X number of  minutes. 

If i go into the aggregation policy and set 'If this episode existed for X second(s)', then any event that is added to the episode after X seconds triggers an additional email, which potentially could be a lot of emails. I haven't been able to find a combination of settings that will just send an email once from the aggregation policy rules.

I considered the option to create an alert search for an episode that has been up for a certain period of time in a 'New' state, but I'd prefer for it to be built into the aggregation policy.

Anyone else hit something similar?

Labels (3)
0 Karma

digithead1
Loves-to-Learn

I worked with Splunk Professional Services consultants for ITSI 4.4.5 and covered this example and another where if the episode was open for x time and the severity was high.  But the first event even being high did not satisfy the severity condition until the time did.  Then it took another event of "high" to meet the second after the the time.  But what if no other events arrive?  Consultants recommended submitting a enhancement request as this is the way the developer currently coded the application.  They have a lot of work on their ITSI solution to be more robust like HP OMi and other more advanced event monitoring systems.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...