Splunk Alert set up based on first occurrence of error

[Dharani]

Hi, 

I want to schedule one splunk alert , please let me know if below option is possible:

1. When the first alert received for xxx error  then query should check if this is the first occurance of an error in last 24 hours  if yes then Alert email can be triggered
2.  If the error is not first occurance then may be based on threshold we should only send one email for more than 15 failures in an  hour or so.

2nd point is basically set up splunk alert for xxx error , threshold: trigger when count>15 in last 1 hour.

1st point is for , when 1st occurrence of error came , it will not wait for count>15 and 1 hr , it will immediately trigger an email.

Please help on this.

[gcusello]

Hi @Dharani ,

yes it's possible, you should:

• setup an action that when the first alert is triggered, it writes an event in a summary index (better) or in a lookup;
• add to you alert the condition that the alert wasn't already triggered reading from the summary index.

If you have Enterprise Security, you don't need the summary index and you can use the Notable index.

Ciao.

Giuseppe