Alerting

How to configure Splunk Alerts to only send one E-mail notification?

johann2017
Explorer

My Splunk alerts are configured to send an e-mail when triggered. How do I make sure that Splunk only sends one e-mail? It seems to be sending two e-mails every time. I think it may have to do with the timing I have configured. My alert settings are as follows:

Settings
Alert Time: Scheduled
Run on Cron Schedule
Time Range: Last 15 Minutes
Cron Expression: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The cron expression translates to At every 10th minute

Trigger Conditions
Trigger Alert When: Number of Results is greater than 0
Trigger: Once
Throttle: (not checked)

1 Solution

nplamondon
SplunkTrust
SplunkTrust

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

View solution in original post

0 Karma

nplamondon
SplunkTrust
SplunkTrust

You have a couple problems here.

As noted in your comment, the cron expression isn't valid. Try */10 * * * * (minute hour date month weekday).

You're probably getting double notifications because your polling time and window don't match. For example, you get an event at 08:09 and poll at 08:10 with a 15min window (07:55-08:10); you'll see the one event and the alert will trigger. You poll again at 08:20 with a 15min window (08:05-08:20); you'll see that same event and trigger the alert again. Either change your range to 10min or change your cron to */15 * * * *.

0 Karma

johann2017
Explorer

Ok cool let me test that out and will post again after. Thanks.

0 Karma

johann2017
Explorer

This worked thank you!

0 Karma

rakshithreddy
Explorer

Hi @johann2017

The cron expression given above is wrong, can you check it

0 Karma

johann2017
Explorer

Hello Rak. The Cron Expression is: star/10 star star star star --> (I had to write the word star in place of * because they were getting removed because of the formatting rules on here) The Cron expression translates to At every 10th minute.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...