Play around with “flush on trigger” and alert throttling :)
Hi,
I would like to know if is it possible to receive one alert for the same action? For, example : for the following example if the same action is repeated several times I want to recive just one alert not more.
action=Login source_address=1.1.1.1 user=titi | chart count() by user
Is it possible ? If yes could you please tell me how do I do ?
Best regards,
SA
Share This Post:
Please sign in to leave a comment.
1 comment