topic date diff until in Alerting

date diff until

DaveBunn — Tue, 19 Mar 2024 16:30:56 GMT

I have an alert which detects when a log feed has failed

The team the alert goes to have asked that I allow them to suppress the alert.

I have now created a mailto link within the alert email that sends and email with a specifically crafted email subject and body that is detected in all future alerts to suppress future alerts for 12hrs.
a simple math calculation generates the 12hrs, the epoch timestamp is in the subject header, the alert spl looks at the subject and either suppresses the alert or not.

This works perfectly - the technical team have now asked that I vary the suppression as follows

If the alert came in before 10AM the suppression remains 12 hours
If the alert came in after 10AM then the suppression time would be "until 10AM the following day".

So - how do you calculate a time stamp to 10AM the following day.
It must be simple but my mind has lost it right now.
Something like is current hour >10AM timestamp=tomorrow:10Hrs

Re: date diff until

richgalloway — Tue, 19 Mar 2024 17:11:15 GMT

Use the relative_time function to calculate time offsets.

| eval new_time = relative_time(now(), "+1d@d+10h")

The format string breaks down as follows:

"+1" : this time tomorrow
"@d": round off the time to 0:00
"+10h": add ten hours

Re: date diff until

DaveBunn — Mon, 25 Mar 2024 09:02:35 GMT

Thanks Rich - logical when you think about it.

Works a treat - thank you

Re: date diff until

richgalloway — Mon, 25 Mar 2024 11:53:35 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.