Alerting

How to configure Splunk Alerts to only send one E-mail notification?

johann2017
Explorer

My Splunk alerts are configured to send an e-mail when triggered. How do I make sure that Splunk only sends one e-mail? It seems to be sending two e-mails every time. I think it may have to do with the timing I have configured. My alert settings are as follows:

Settings
Alert Time: Scheduled
Run on Cron Schedule
Time Range: Last 15 Minutes
Cron Expression: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The cron expression translates to At every 10th minute

Trigger Conditions
Trigger Alert When: Number of Results is greater than 0
Trigger: Once
Throttle: (not checked)

1 Solution

nplamondon
Communicator

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

View solution in original post

0 Karma

nplamondon
Communicator

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

0 Karma

johann2017
Explorer

Ok cool let me test that out and will post again after. Thanks.

0 Karma

johann2017
Explorer

This worked thank you!

0 Karma

rakshithreddy
Explorer

Hi @johann2017

The cron expression given above is wrong, can you check it

0 Karma

johann2017
Explorer

Hello Rak. The Cron Expression is: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The Cron expression translates to At every 10th minute.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...