Alerting

Options to snooze Splunk Alert

arunsubram
Explorer

Hi, Wanted to check on solutions to snooze Splunk Alert. When a service is down, we disable the Splunk Alert till it is being worked. Sometime, the engineer forgets to enable to Alert back. is there a Add on or option in splunk to snooze for 1 hour or so and turn the Alert back ON. Kindly suggest.

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @arunsubram,

Instead of enabling/disable Alerts I suggest to set Throttle in alerts. In your case, you can Throttle alerts for 60 min. Please refer below link for more information.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Alert/ThrottleAlerts

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...