Splunk Search

search-alert in specified time window

parth_jec
Path Finder

I want to create real time alerts from search which is fired when a condition is met but only between a specific time duration. ex: 9AM to 5PM every weekday exluding weekends. How can I do that?

I found an answer on below link, wondering how can I restric this search to run only during weekdays
http://splunk-base.splunk.com/answers/2219/search-command-for-work-time

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

View solution in original post

yannK
Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...