Alerting

How to ignore the duplicate count

ManojPottella
New Member

Hi Team,

As per below output I want to know the exact count of disconnected status of each server_name by ignoring the duplicate counts.

As we are using script from splunk to ingest the server status every 5 min, once slunk triggered an alert with server is disconnected, we are manually starting and it will take 15-20 min, in between 3/4 times script will execute and ingest the server status into splunk .

in this if count the total count if disconnected state by using stats count it will include the duplicate count as well, but we need to identify the exact count.

     Server_Name             Status
server1.example.com         disconnected
server1.example.com         disconnected
server1.example.com         connected
server1.example.com         connected
server1.example.com         connected
server1.example.com         disconnected
server1.example.com         disconnected
server1.example.com         connected
server1.example.com         connected
server1.example.com         connected
server2.example.com         disconnected
server2.example.com         disconnected
server2.example.com         disconnected
server2.example.com         disconnected
server2.example.com         disconnected
server2.example.com         connected
server2.example.com         connected
server2.example.com         disconnected
server2.example.com         disconnected
server2.example.com         connected
server3.example.com         connected
server3.example.com         disconnected
server3.example.com         disconnected
server3.example.com         disconnected
server3.example.com         connected
server3.example.com         disconnected
server3.example.com         disconnected
server3.example.com         disconnected
server3.example.com         connected
server3.example.com         connected
server3.example.com         disconnected

server3.example.com disconnected
server3.example.com disconnected
server3.example.com connected

as per above result we are expecting disconnected count of each server is

server1.example.com - disconnected - count=2
server2.example.com - disconnected - count=2
server3.example.com - disconnected - count=3

any logic , please suggest ...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ignoring events that have already been alerted is a built-in feature of Splunk. Use the 'throttling' settings in your alert. Tell it to throttle alerts for 15 minutes based on the Server_Name field.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...