Alerting

Why is my Splunk email trigger sending an email for every host found?

mbrannaman
New Member

I created an alert with:

index=xxxx "Error Message"|
stats count as COUNT by host|
where COUNT > 6000

and an alert with the trigger condition where COUNT > 6000 and to send a message for each result.

The issue I have is that the alert returns only 2 records, but the alert sends an email for every single host.

How can I have emails sent for just the hosts returned?

Thanks!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@mbrannaman,

If you have the where condition already part of the search, remove it from the trigger condition and add No of Results is greater than 0

Happy Splunking!

View solution in original post

0 Karma

woodcock
Esteemed Legend

I am very confused by the way you have phrased your question but in addition to what @renjith.nair said, you might need to change the alert's digest setting.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@mbrannaman,

If you have the where condition already part of the search, remove it from the trigger condition and add No of Results is greater than 0

Happy Splunking!
0 Karma

mbrannaman
New Member

Thanks! But it still returns an email for every host regardless of the count.
The issue I have is (I think) the docs are pretty sparse, but it says the alert triggers off the base search - which does not include the count or the where.
I am not sure how to combine a count and where into the base search of
index=xxxx "Error Message"|
Any ideas?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Term base search might be confusing but whatever you are doing in your search above should work with the alert. Please make sure that the time frame you select for your search and alert are same, i.e. verify the alert configuration and check the time window/range.

Also, check the recent alert - view recent -> Jobs -> Actions > Job -> Inspect Job and check the search log. This should give you information about the search ran for the alert

Happy Splunking!
0 Karma

mbrannaman
New Member

I think I found the issue - I right clicked on the alert and opened the search in a separate panel to edit it, as well as the alert settings in the original pane.
Editing and saving the search in the new panel did not save it in the actual. Discovered that when I reopened the alert and saw it had not been saved for whatever reason.
Thanks for the help.

0 Karma

woodcock
Esteemed Legend

If it doesn't work, why did you click Accept?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...