Splunk Search

Throttling-parameters in realtime search

linu1988
Champion

Hello Everyone,
I have created alerts where i have to throttle according the fields.

So my doubt is, whether i need to put the Renamed filed / the actual fields in throttling parameters

e.g. index=main source=service | table host,service,Status| where Status="stopped"|RENAME host as "Server_Name"|RENAME service as "Service_Name"

Throttling fields: host, service OR should be Server_Name, Service_Name
Alerts are per result basis. Please suggest on the scenario.

Tags (1)
0 Karma
1 Solution

linu1988
Champion

Hello,
I have figured it out by testing all the cases ,We always need to use the RENAMED field name for throttling, or it will not work

View solution in original post

0 Karma

linu1988
Champion

Hello,
I have figured it out by testing all the cases ,We always need to use the RENAMED field name for throttling, or it will not work

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!