topic Re: How to create email alert? in Alerting

How to create email alert?

mnj1809 — Thu, 24 Feb 2022 22:19:53 GMT

I supposed to get the some data in Splunk twice in a day. I want to create 2 email alerts as follows:

9 AM email alert: should alert if no data received at 5 AM and/or if no data received previous day at noon.
3 PM email alert: should alert if no data received at noon and/or if no data received earlier the same morning at 5.

Thanks for your help in advance.

@bowesmana

gcusello — Fri, 25 Feb 2022 07:04:52 GMT

if I correctly understood, you want to schedule:

an alert at 9.00 AM using as time period 17 hours (from 12.00 of previous day to 5.00 of present day),
an alert at 15.00 using as time period 7 hours (from 5.00 of present day to 12.00 of present day).

Is it correct?

If the time period is the same 8always 12 hours) you could schedule only one alert using this cron expression

0 9,15 * * *

Otherwise, you have to schedule two alerts that differ only for the time period, in other words:

Alert 1, scheduled at 9.00

cron

0 9 * * *

index=your_index earliest=-21h@h latest=-4h@h

Alert 2, scheduled at 15.00

cron

0 15 * * *

index=your_index earliest=-10h@h latest=-3h@h

The condition is always

results=0

Ciao.

Giuseppe

gcusello — Mon, 28 Feb 2022 07:58:28 GMT

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

mnj1809 — Mon, 28 Feb 2022 07:58:33 GMT

Thanks for you answer. Your answer helped me what I want to achieve.