topic Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time? in Alerting

How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

karthi2809 — Wed, 15 Nov 2017 16:08:34 GMT

How to customize alert should not trigger for particular time from 1 AM to 6.30AM?

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

elliotproebstel — Wed, 15 Nov 2017 17:09:25 GMT

Do you want the alert to not run at all during that time, or to run but not alert on events that happen in that time? How frequently is the alert scheduled to run right now? I'd like to help!

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Wed, 15 Nov 2017 17:33:30 GMT

Hi karthi2809
insert in your main search this condition:

date_hour>=1 AND (date_hour<7 AND date_minute<31)

if this condition must run only in some days of the week insert an additionan condition with date_wday.
Bye.
Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

karthi2809 — Thu, 16 Nov 2017 05:12:47 GMT

Thanks cusello

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

karthi2809 — Tue, 29 Sep 2020 16:44:53 GMT

Hi Cusello,

index=docker fatal NOT date_hour>=1 AND (date_hour<7 AND date_minute<31)

will this query works.

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

karthi2809 — Mon, 20 Nov 2017 06:44:48 GMT

Hi cusello,

The query is not working the alert is triggering at that time.

Thanks,
Karthigeyan

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

niketn — Mon, 20 Nov 2017 07:33:31 GMT

@karthi2809, can you share your alert query?

Can you display date_hour as well in your alert? Is it possible that there is difference in the timezone for your data and your local time zone?

Try the following:

index=docker fatal (date_hour<1 OR date_hour>6) OR (date_hour=6 AND date_minute>30)

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Mon, 20 Nov 2017 07:54:10 GMT

Hi karthi2809,
the NOT condition must be all in parenthesis:

index=docker fatal NOT (date_hour>=1 AND (date_hour<7 AND date_minute<31))

otherwise only the first condition is called.

Bye.
Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

karthi2809 — Mon, 20 Nov 2017 09:39:11 GMT

Hi elliotproebstel,

At that time we are taking backups files .so that time i dont need alerts .so i have to disable alert for that time.

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Mon, 07 Jun 2021 11:22:54 GMT

Hi @gcusello - Looks like this condition isn't working in the query where we use "stats" part of query for CPU, Memory, Disk space alerts. Kindly suggest

NOT (date_wday=monday AND date_hour>=00 AND (date_hour<07))

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Mon, 07 Jun 2021 11:26:18 GMT

Hi @sureshkumaar,

the object of date_hour is a number, "00" and "07" aren't number, did you tried:

NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7))

Ciao.

Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Mon, 07 Jun 2021 12:03:14 GMT

Hi @gcusello - I tried now but still results are getting shows in the events view

NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7))

What I could observe here is when the stats command in place _time field isn't working in Splunk so the condition we use here looks for the query where _time filed is effectively used.

Kindly let me know your thoughts/observations on this

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Mon, 07 Jun 2021 12:11:07 GMT

Hi @sureshkumaar,

sorry I was wrong, after a stats command, you haven't more the date_wday and date_hour fields but you have only the fields in the stats.

Could you share your search?

Ciao.

Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Mon, 07 Jun 2021 12:25:27 GMT

Hi @gcusello - i cannot share the actual/complete search but something with Splunk fields i can share

source=*cpu* cpu_load_percent>75 NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7)) | stats latest(cpu_load_percent) as cpu_max_usage by _time, host | table _time host cpu_max_usage

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Mon, 07 Jun 2021 12:30:12 GMT

Hi @sureshkumaar,

try something like this:

source=*cpu* cpu_load_percent>75 NOT (date_wday="monday" date_hour<7) | stats latest(cpu_load_percent) as cpu_max_usage by _time, host | table _time host cpu_max_usage

In this way, you exclude alerts fired on monday between 0 and 6.

Ciao.

Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Mon, 07 Jun 2021 13:08:51 GMT

Hi @gcusello - Still not working and results are getting displayed

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Mon, 07 Jun 2021 16:38:13 GMT

Hi @sureshkumaar,

what's the time period of your search?

in this way you exclude events from 00 to 7.00 but alert is running so if you have events at 23.55 and you run your alert at 0.30 the alert is fired!

Do you want to exclude events from 00 to 7.00 or avoid to run alert?

If you don't want to execute the alert between 00 and 7.00 you have to configure your cron.

Ciao.

Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Mon, 07 Jun 2021 16:52:06 GMT

Hi @gcusello - The time period of my search is "Last 30 minutes", But for testing purpose to check the working of that "NOT" condition I modified to search "Today" as time range to look for results for that time returning or not.

But the results are showing the stats value between the time 1 AM - 3 AM

NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7))

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

gcusello — Tue, 08 Jun 2021 06:57:26 GMT

Hi @sureshkumaar,

it's a really strange behaviour!

Anyway, only for debugging, what does happen if you:

don't use NOT (first try),
don't use date_wday="monday" (second try)

Ciao.

Giuseppe

Re: How to disable splunk alert from 1 Am to 6.30 Am .for particular time?

sureshkumaar — Tue, 08 Jun 2021 11:20:35 GMT

Hi @gcusello - I tried those steps but still not working. I have attached the snapshot for reference.

Initially with actual query

Later without NOT and then also without date_wday=tuesday

source=*cpu* cpu_load_percent>75 NOT (date_wday=tuesday AND date_hour>=0 AND (date_hour<3)) | stats latest(cpu_load_percent) as cpu_max_usage by _time, host | table _time host cpu_max_usage