Splunk Search

How do I specify multiple separate fields in the "supress alerts with field value"

jguglielmi
New Member

I am reporting on batch processing.
At the highest level there us the concept of a "Batchid" and within each batchid there can be multiple "Jobid"'s.
Each job can possible fail which provides a literal "error" in a field I interrogate.
I want to alert based on every time a unique BatchID has an "error" field associated.
However, I want to check every 10 minutes and only send an alert when the batchid and jobid's are different.
If I just supress based on the same batchid being present, I might miss the case where the origonal jobid gets resoved, but the next job under the same batchid fails.
This is what I want to do:

batchid jobid action
1234 432 alert
1234 432 throttle wait
1234 567 alert
1267 123 alert

Tags (1)
0 Karma

maciep
Champion

Is this what you're referring to? I think you can put multiple fields in that throttle field list. So you can put it batchid and jobid in there maybe?

http://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts

If that doesn't work or isn't an option, what about just eval'ing a new field in your search and then throttle based on it?

... | eval throttle_field = batchid." - ".jobid | ...

And then just choose that field for the throttling logic?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...