Alerting

Email Alerting error

christinmb
Path Finder

Hi, I'm having error with the alerts sent by email since I upgraded to Splunk 5.
I have a real time alert search but Im getting this alert sent to my email all day with the same event and I think its something I did wrong in the configuration.
I attach the alert configuration, thanks in advanced.

alt text

0 Karma

qjvtenkroode
Explorer

This depends on the window in which the real-time search is run. For example lets assume a window of 30 min and the throttling you have configured (10 min). Now lets say the search has two results (seen at time 0), Splunk sends an email and keeps quiet for 10 min.

Now after 10 min the throttling is turned off and still these two events are seen since the window rolls over 30 min, this time at time 10. Thus another email is send and so on.

Solutions to this can be to decrease or increase the real-time window (once again I don't know your setting since it is not shown in the screenshot), to adjust the condition (ie. number of events greater than 10 instead of 1) or to adjust the throttling time to match the real-time window.

0 Karma

qjvtenkroode
Explorer

Well by setting the search to rt, rt and the alert mode to "once per result" you will be alerted for every event after one event is found. (ie. the second, the third, the fourth and so on).

It really depends on what you're trying to achieve.

0 Karma

christinmb
Path Finder

The time range i have is:
# start time: rt
# finish time: rt

Alert mode is in "once per results" with the same alert condition showed in the screen shot

And I disabled the Throttling option

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...