Alerting

How do I create an alert that triggers when a specific event is found for the first time in a day, but is ignored if the same event is found a second time?

maniu1609
Path Finder

How to create alert if specific event found first time in a day and ignore creating alert if the same event found second time in day?

We are indexing web services errors in Splunk. Here are some cases we are involved in.

  1. We need to create an alert if we find an error text for a web service in a day. If we find the same error text for the same web service, then an alert shouldn't be created.

  2. This scenario will be a tricky one. If the alert finds 2 error texts: For one error text , we already raise an alert as it is the first error in a day. For another error text we need to send alert as it's new now.

Please help me how we can handle this.

0 Karma

HiroshiSatoh
Champion

I think that you should use deterrence of alerts.
Set the field to be used for deterring and set the suppression period to 1 day.

alt text

0 Karma

Vijeta
Influencer

What is the frequency of execution of alerts? you can search based on the time window if there are more than one events generated then set a variable as true or 1. Based on the value of variable you can have a conditional alert.

0 Karma

maniu1609
Path Finder

Thanks Viji. I have set frequency as 15 mins. Could you please with an example please.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...