How to turn off an alert for 30 minutes on a given day?

[cj039165]

Hello -

I have an alert that I want to 'suppress' / 'turn off' for 30 min a week. Every Sunday a connection is dropped from 2:45pm to 3:15pm. The drop is part of 'normal' Sunday work that occurs. We don't need the 'false positives' hitting our on-call. Is there a way to stop alerting for just 30 min on a given day?

Thanks,

Carl

[SierraX · Accepted solution]

Hello,
I would embed it in a search:

With a search

 | search NOT dactivate=*

Kind Regards
SierraX

[cj039165]

Hello -

Got back to working on this. For some reason this is still alerting between 14:45 and 16:00 on Sundays. Not sure what I'm missing. Thanks.

index=hdx_was source="/hdx1/was70-32/AppServer/profiles/AppSrv01/logs/PRD3_XF*/SystemOut.log" "A connection failed but has been re-established" | eval wday=strftime(now(),"%a"),homi=strftime(now(),"%H%M"),dactivate=if(wday="Sun" AND homi>=1445 AND homi<=1600,"off",NULL)

[cj039165]

Thanks for the help.

[cj039165]

Thanks for the response SierraX. Here is the search I'm running. New to Splunk, I'm getting an error message "Error in 'eval' command: The expression is malformed. Expected"

index=hdx_was source="/hdx1/was70-32/AppServer/profiles/AppSrv01/logs/PRD3_XF*/SystemOut.log" "A connection failed but has been re-established" |eval wday=strftime(now(),"%a"),homi=strftime(now(),"%H%M"),dactivate=if(wday"Sun" AND homi>=1445 AND homi<=1530,"off",NULL)

[SierraX]

Sorry for the late response...
when this is a 1to1 copy of the search, you forgot a = (equal) between wday and "Sun"

[jkat54]

You'd have to write a cron type schedule for that or possibly more than one cron schedule. All these assume you run every 15 minutes.

Something like

 */15 * * * 1,2,3,4,5

And another for Sunday normal hours.

 */15 0,1,4-23 * * 0

Then one for 2-230 and 315-4 on Sunday

 0,15,30 2 * * 0
 15,30,45 3 * * 0

But use the same search for all... Name them differently, etc.