Title: Set splunk alert to send alerts for each host
Tags: splunk
Question: I am setting up my Splunk search/alert to search for an error in a group of servers. How can i set the alert to mail me when the error happens on multiple hosts but only once for each host?
For example, if the error is continuously happening on two hosts from a group of 6, I need to get two alerts(one for each host) but only once till the next day. (for the once till the next day option I am using the throttling feature)
Is that possible with splunk?


Here is another answer: I figured it out. In the throttle settings, I put the suppress the field value as host and set the alert for every occurence. This way, it sent alert once for all the hosts and then supressed everything till the supress threshold.

Here is another answer: To throttle by specific fields you must select the "For each result" option in the Trigger Conditions section.  Then put "host" in the "Suppress results containing field value" box.
See http://docs.splunk.com/Documentation/Splunk/7.2.0/Alert/ThrottleAlerts

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 2, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2018:00:10/11/18', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<splunk>', 'Title': 'Set splunk alert to send alerts for each host', 'ViewCount': 2421, 'id': 52763726, 'user_AboutMe': None, 'user_AccountId': 3182698.0, 'user_DisplayName': 'user2689092', 'user_Reputation': 295.0, 'user_Views': 18.0, 'user_id': 2689092.0}}