Prevent alerts from reopening (create new alerts instead)

[Luke Van Epen]

Forgive me as I'm quite new to the Event management product. We have an event > alert integration with Splunk going at the moment. Right now we have it set up so that alerts Reopen and that reopens an incident, which i believe is how it comes OOB.

I've managed to figure out how to stop it from reopening incidents and create new ones instead, however that isn't good enough for the customer, they would like a way to prevent alerts from ever reopening once they are closed. This is easy enough to do with a rule, but they want it so that a new Alert (and new Incident if necessary) is created under the the conditions that would normally cause an Alert to reopen.

I've been reading through the Alert docs and haven't found anything to suggest this is possible via a property or config change (like with the reopening of incidents) which leads me to believe this requirement is going to need some heavy bastardization customization.

Has anyone had to do this before? Hopefully I'm just missing something obvious.

[Alexander Mitov · Accepted solution]

Go to Event Management >> Settings >> Properties and look for:

Please note that this setting is global and will affect the behavior of all Event Management integrations. More info on those properties is available here.

[Gianpaolo Pagan]

hi there, I think this could help getting the behaviour you want:

Gp

[robertgeen]

What Alexander said is the way to do it. You could always set that to a very small number which would essentially make it create a new alert every time.

[joe_steinfeld]

Setting this to 0 will turn off the interval and cause new events to create new alerts and not re-open existing ones.