Why does my real-time alert continue to send emails/sms?

[blindfire_bandi]

I have a query for which I've configured a real-time alert when the query returns a result. I'm getting 25 to 35 emails and texts, and I really just need 1 of each. I'm not sure what I've set incorrectly here.

index = chm source="CH_HealthMonitorHighLevel"
| fillnull value=""
| eval StartTime = relative_time(now(),"-10m")
| where _time >= StartTime and (AppID == 16 or AppID == 41)
| where NOT StatusID == 0 AND NOT StatusID == 1

[bangalorep]

The alert is getting triggered repeatedly as the event will be populated multiple times in the 10 minute duration. If you run this search every 10 minutes you should get a single mail only.

[whrg]

Can you post a screenshot of the Trigger Condition?

Also, is there a specific reason why you are using a real-time alert? Because real-time alerts are more costly in terms of computing resources than schedules alerts.

[blindfire_bandi]

@whrg It's attached to the question as alert.png. As far as the real-time is concerned, we're using real-time because we have single value panels that turn yellow to warn and red to indicate "down" for several applications. The operators who are on-call will only be interested in being alerted when something is at the warn or down state.

[paranjith · Accepted solution]

Real time searches run continuously and since, the window specified is 10 minutes, even for one result, it triggers multiple alerts. You can set the throttle to suppress triggering for 10 minutes (that way, the search waits for 10 minutes before triggering the alert again). Hope this helps

[blindfire_bandi]

@paranjith The throttling has fixed my issue. Thank you