Splunk IT Service Intelligence

ITSI Duplicate Alerts (Action)

New Member


I'm trying to configure a NEAT that would send one email / raise one SNOW incident for each episodes.

I tried a few different Action Rules:

  • Number of events in episode >= 1 --> this would send emails for every notable events instead of one for the episode, and will continue sending emails until the episode breaks
  • Number of events in episode == 1 --> this does not trigger emails, since the episodes would typically have 3-4 events

I have a different NEAP for a different type of alert where it would raise the incident correctly after the 3rd (same) event e.g. after 15 minutes at 5 mins search interval - by using:
- Number of events in episode == 3

In this case though, the events are generated all at once, and there could be 1-8 events from different environments that I'm aggregating to one episode.


Labels (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!