Alerting

How to set alert and mail appears only once

davidde
New Member

Hello,

I'm calculating percentage of x events per month and I also put them into alert mode and set mail notifications - so that works now. The problem is I would like to configure it so that mail appears only when percentage of x events reaches 99,99% per month and never appears again - next time when I will receive mail in would be for a next month and so on... Is it possible to configure? Because I'm getting mails every day now, because the event matches every day...

Thank you in advance and have a nice day,

David

Tags (2)
0 Karma

acharlieh
Influencer

It sounds to me that you might be looking for Alert Throttling ?

0 Karma

davidde
New Member

I will try that too, thank you! 🙂

0 Karma

MichaelPriest
Communicator

Have you got the details for your alert i.e your search string?

If you want it to run once every month you could try a scheduled alert.

0 Karma

davidde
New Member

index="january" OR index="february" OR index="march" OR index="april"| eval Month=strftime(Month,"%Y-%m-%d") | where Percentage >= "0.9999"| eval Percentage=Percentage*100| eval Percentage= substr(Percentage, 1, len(Percentage)-2)| eval Percentage1= replace(Percentage,".",",")| eval "Percentage"=Percentage."%"|eval Percentage= replace(Percentage,".",",")| table Month Percentage| dedup Month

For now result is Month=2015-01-01 and Percentage=99,99%..... Ok, so i got that mail and don't want to receive it till 99,99% appears in February... Actually 99,99% in month can appear few months from now or can appear tomorrow...

0 Karma

stephanefotso
Motivator

Hello, i read your comment above and i think that this may help:

Search query:

index="january" OR index="february" OR index="march" OR index="april"| eval Month=strftime(Month,"%Y-%m-%d") | where Percentage >= "0.9999"| eval Percentage=Percentage*100| eval Percentage= substr(Percentage, 1, len(Percentage)-2)| eval Percentage1= replace(Percentage,".",",")| eval "Percentage"=Percentage."%"|eval Percentage= replace(Percentage,".",",")| table Month Percentage| dedup Month

Save it as an Alert.

Title: your alert Title
Alert Type: Real Time
Trigger Condition: Number of Results
Trigger if Number of Results is **: Greater than 0
**in
: 30 days
click on next
....

Thanks

SGF
0 Karma

laserval
Communicator

I'd avoid Real Time alerts for this, since each such alert is a real-time search that uses up a lot of CPU.

Run it as Scheduled, every minute, instead. That's near-real-time enough for most email alerts.

0 Karma

stephanefotso
Motivator

That is true,

Title: your alert Title
Alert Type: Scheduled
Timerange: Run Every month
Schedule on day: choose the day
Trigger Condition: Number of Results
Trigger if Number of Results is : Greater than 0
...

SGF
0 Karma

MichaelPriest
Communicator

Then add in throttling for 30 days.

But the only problem with this is not every month has 30 days

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...