Alerting

correlation rule is configured as time range -65m to -5m and cron schedule is every 5 minutes then why will there not be duplicate alerts for every 5 min?

lalitha101
New Member

correlation rule is configured as time range -65m to -5m and cron schedule is every 5 minutes then why will there not be duplicate alerts for every 5 min?

0 Karma

woodcock
Esteemed Legend

If you have accurately (completely) documented your configuration then you almost certainly will see duplicates.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without any context I'm guessing there's a throttling window of 60 minutes defined on some key field to suppress repeat events.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.