Alerting

Customize time for alerts

theouhuios
Motivator

Hello

I have a alert running for every 5 mins to check the service status and alert when it's STOPPED. Everyday from 3:15 to 4:15 all the services will be STOPPED. Is there anyway that I can make that search not to run for that 1 hour and stop sending emails. As we all know that services will be down for sure in that 1 hour period we don't need to get alerted for that 1 hour.

Any ideas

Tags (1)
0 Karma

BobM
Builder

Hi Theo

If your server was down for a clean hour, it would be a simple task to use cron to schedule it. For example the following would work every 5 mins from midnight to 2:55 and then 4:00 onwards.

*/5 0-2,4-24 * * *

For your timing, this is not so simple. I would normally use the date_hour and date_minute fields to calculate the time but your report may not have them. What you could do is modify the search by adding the following at the end of the search.

| eval timeInMin=(now()-relative_time(now(), "@d"))/60 | where (timeInMin < 3*60+14) OR (timeInMin > 4*60+16)| fields - timeInMin

This would delete any results if the time was between 3:15 and 4:15. If this doesn't work, please tell us how you have your alert set up.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...