Alerting

Time based alerts

diegosainz
Path Finder

I would like to create an search that triggers one alert for work hours and a different alert for after hours alerts. Any input would be helpful. Thank you

Tags (3)
0 Karma

jlanders
Path Finder

Another option would be to run one report inside of Splunk but trigger an external script that performs whatever alerting actions you need. That script could also check the time of day.

0 Karma

BobM
Builder

If you were to make two copies of the alert search and schedule them with cron, you could have different alert actions for each one. For example set one with a cron schedule of

cron_schedule = */2 9-17 * * *

to alert every half hour from 9am to 5:30pm and email the helpdesk. Another with cron of

cron_schedule = */2 0-8,18-24 * * *

to alert from 6pm to 8:30 and run a script to page the on call person.

diegosainz
Path Finder

Thank you Bob. I will take a crack at that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...