Splunk Search

Throttling does not send multiple emails

bsizemore
Path Finder

Hi,

I have my throttle set to send an email for each result, but of the 3 I expect I am only getting 1. What am I doing wrong?

index=something sourcetype=something serviceName=comparator NOT errorCode=abc123 level=ERROR 
| multikv
| stats count by masterId message
| search count >44 
| table masterId count message 
| rename message as "Repeated Error Message"

tmpdmp.com/b14cec96f23eb0dd/0e4c331c27983435

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Odd, this alert appears to throttle correctly for me:

alt text

0 Karma

bsizemore
Path Finder

I removed the quotation marks, but it still doesn't work. I will use the alternate method you mentioned. Thanks for the reply.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.