Splunk Search

Splunk alert to be triggered based on time of the day

anweshar
New Member

My search condition is checking for results less than 10 every 45 minutes. The problem is we don't have that much traffic in the night to make it up to 10 searches. Is there an option to alert based on time of the day, for example trigger an alert if the number of searches is less than 10 between 09:00 to 18:00 and in the off hours trigger an alert if the number of searches is less than 3.

I can write a separate splunk alert to cover off hours but wanted to check if there is an option to do this in the one alert.

0 Karma

adonio
Ultra Champion

you can write an eval statement for example and alert on its results, example:
... your search ... | eval bus_hours = if(date_hour>=9 AND date_hour<=18,"yes","no") ...
| eval alert = if(your_count < 10 AND bus_hours = "yes","alert","not_alert) ...

and now count the new alert field or configure your alert however you want

hope it helps

0 Karma

jkat54
SplunkTrust
SplunkTrust

I've been told not to use date_wday with stats due to some typical fringe cases where it's inaccurate. It's a calculated field after all.

It would be better (again I'm told by the smarter folks) to eval the hour like this:

| eval hour=strftime(_time,"%H")

Then use the conditional logic on it.

0 Karma

woodcock
Esteemed Legend

The date_* fields can be used IF they are there (there are not in every sourcetype/event); just be aware that they are interpreted to be in the timezome of the local event, not normalized to GMT/Zulu.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...