Splunk Search

Throttling-parameters in realtime search

linu1988
Champion

Hello Everyone,
I have created alerts where i have to throttle according the fields.

So my doubt is, whether i need to put the Renamed filed / the actual fields in throttling parameters

e.g. index=main source=service | table host,service,Status| where Status="stopped"|RENAME host as "Server_Name"|RENAME service as "Service_Name"

Throttling fields: host, service OR should be Server_Name, Service_Name
Alerts are per result basis. Please suggest on the scenario.

Tags (1)
0 Karma
1 Solution

linu1988
Champion

Hello,
I have figured it out by testing all the cases ,We always need to use the RENAMED field name for throttling, or it will not work

View solution in original post

linu1988
Champion

Hello,
I have figured it out by testing all the cases ,We always need to use the RENAMED field name for throttling, or it will not work

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...