Splunk Search

Throttling does not send multiple emails

bsizemore
Path Finder

Hi,

I have my throttle set to send an email for each result, but of the 3 I expect I am only getting 1. What am I doing wrong?

index=something sourcetype=something serviceName=comparator NOT errorCode=abc123 level=ERROR 
| multikv
| stats count by masterId message
| search count >44 
| table masterId count message 
| rename message as "Repeated Error Message"

tmpdmp.com/b14cec96f23eb0dd/0e4c331c27983435

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

In essence this is almost the same issue as http://answers.splunk.com/answers/133059/throttle-saved-search-returns-1-email-istead-of-70 - troublesome field names. Your other question stumbled over case sensitivity, now you're stumbling over field names containing spaces.

In the rename command you're correctly enclosing the field name containing spaces in double quotes, but that fails for the list of throttling fields: Down there that's being interpreted as a string, hence you're only getting one alert per two minutes instead of one for each of your three values. You can fix that by removing the double quotes in the throttling fields list.
Personally I prefer not to use spaces or other \W characters in field names if they're used for subsequent calculations. For example, using a field named "foo-bar" in the RHS of an eval command will make Splunk subtract field bar from field foo 😄

martin_mueller
SplunkTrust
SplunkTrust

Odd, this alert appears to throttle correctly for me:

alt text

0 Karma

bsizemore
Path Finder

I removed the quotation marks, but it still doesn't work. I will use the alternate method you mentioned. Thanks for the reply.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...