topic Re: Splunk Alert needed for a specific time frame in Alerting

Splunk Alert needed for a specific time frame

johann2017 — Tue, 21 Feb 2017 20:50:36 GMT

Hello all, using Splunk Enterprise here. I want to create a Splunk Alert based off one of my searches/saved reports. I need it to run Mon-Sunday between 5pm - 7am the following day in 15 minute intervals. I want it to alert ONLY for events that occur between 5pm - 7am. I almost got it to work, however when the e-mail alert comes in it has a listing of ALL events that happened for the entire day, and I need it to give me events that only occurred in the 5pm-7am range. Here is the Cron Expression I am using: */15 0-7,16-23 * * * Any ideas?

Re: Splunk Alert needed for a specific time frame

richgalloway — Tue, 21 Feb 2017 21:02:12 GMT

Cron tells Splunk when to run the search, but it doesn't tell it what data to look at. That's where the Earliest and Latest settings come into play.

Re: Splunk Alert needed for a specific time frame

johann2017 — Tue, 21 Feb 2017 21:13:39 GMT

Hello Rich. Yea I am not really sure how the Earliest and Latest works, I see those options there but does not really make sense in my scenario.

Re: Splunk Alert needed for a specific time frame

JDukeSplunk — Tue, 21 Feb 2017 21:29:07 GMT

Well, if the search runs every 15 minutes, then somewhere in the first search line put

<yourbasesearch> earliest=-15m latest=now

Re: Splunk Alert needed for a specific time frame

richgalloway — Tue, 21 Feb 2017 21:32:13 GMT

Have you clicked the "Learn more" link under those options to see how they work?
The difficulty in your scenario is midnight. Setting Earliest=@d+17h will look for events after 5pm today (Mon), but when the search runs at 00:15 it will look for events after 5pm on Tuesday.
It's a tricky problem for which I don't have a solution at the moment.

Re: Splunk Alert needed for a specific time frame

somesoni2 — Tue, 21 Feb 2017 21:42:53 GMT

If you open your alert search from "Alerts" dashboard, what is the timerange picker values? OR if you open it from settings, what is the Start time and Finish time values?

Re: Splunk Alert needed for a specific time frame

nickhills — Tue, 21 Feb 2017 21:47:09 GMT

What about using:
<your search> (date_hour>=17 OR date_hour<7)

and then your cron just runs every 15 mins during your alert hours?

not tested, but feels like it should work 🙂

Re: Splunk Alert needed for a specific time frame

johann2017 — Tue, 21 Feb 2017 22:23:54 GMT

Could I create two different alerts to solve this? One for 5pm through Midnight and a second alert for Midnight through 7am?

Re: Splunk Alert needed for a specific time frame

johann2017 — Tue, 21 Feb 2017 22:24:51 GMT

And when I use earliest/latest options do I use the Cron job along with it too or only one or the other?

Re: Splunk Alert needed for a specific time frame

richgalloway — Wed, 22 Feb 2017 03:11:38 GMT

That's an option.

Re: Splunk Alert needed for a specific time frame

richgalloway — Wed, 22 Feb 2017 03:11:48 GMT

You should use both,

Re: Splunk Alert needed for a specific time frame

johann2017 — Thu, 23 Feb 2017 22:12:17 GMT

Thanks rich. I used both and I seem to have got it working.

Re: Splunk Alert needed for a specific time frame

johann2017 — Thu, 23 Feb 2017 22:13:03 GMT

Thanks JDuke!

Re: Splunk Alert needed for a specific time frame

richgalloway — Fri, 24 Feb 2017 19:12:21 GMT

Please accept an answer.

Re: Splunk Alert needed for a specific time frame

rodrigo_santos — Wed, 30 Sep 2020 00:33:56 GMT

(date_hour>=17 AND date_hour<7)