Throttling does not send multiple emails

[bsizemore]

Hi,

I have my throttle set to send an email for each result, but of the 3 I expect I am only getting 1. What am I doing wrong?

index=something sourcetype=something serviceName=comparator NOT errorCode=abc123 level=ERROR 
| multikv
| stats count by masterId message
| search count >44 
| table masterId count message 
| rename message as "Repeated Error Message"

tmpdmp.com/b14cec96f23eb0dd/0e4c331c27983435

[martin_mueller · Accepted solution]

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

[martin_mueller]

Odd, this alert appears to throttle correctly for me:

[bsizemore]

I removed the quotation marks, but it still doesn't work. I will use the alternate method you mentioned. Thanks for the reply.