Alerting

only alert on new events

aledav
New Member

Hi everyone,

We recently set up Splunk for testing. One of the features I'm most interested in right now is the "Alert" functionality.

I have created a alter that runs every day at 06:00. The alert find the events I'm searching for and creates a alert. The only issues is that every new alert also includes events that are older than 24 Hours. I would like to only alter on events that are newer than 24 hours.

Is this possible?

/ Alexander

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Sure. Define the timerange for the search you're using to be last 24 hours. Have a look at the section "Start by defining and saving a search" in this section of the docs: http://docs.splunk.com/Documentation/Splunk/latest/User/SchedulingSavedSearches

View solution in original post

0 Karma

Ayn
Legend

Sure. Define the timerange for the search you're using to be last 24 hours. Have a look at the section "Start by defining and saving a search" in this section of the docs: http://docs.splunk.com/Documentation/Splunk/latest/User/SchedulingSavedSearches

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...