topic Re: How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule? in Alerting

How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule?

tkmads1 — Thu, 06 Aug 2015 07:21:55 GMT

I want to create a splunk alert and schedule it in such a way that it should bypass the particular timeframe (e.g it should not run between 9 PM to 12 AM).

How can do it?

Re: How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule?

alacercogitatus — Thu, 06 Aug 2015 16:36:26 GMT

Use Cron.

1 1-20 * * *

That will work for all hours from 1AM - 8PM. I typically don't start things at the top of the hour to avoid resource contention with other hourly crons that may be installed on the system.

Edit: I double checked the syntax and had forgotten that a range can work as well.

Re: How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule?

woodcock — Thu, 06 Aug 2015 16:49:16 GMT

You can short-circuit the job during the blackout period by using addinfo and map for the blackout period that it is not supposed to run like this (extra steps for clarity):

| noop | stats count AS myHourMin | addinfo | eval myHourMin=tonumber(strftime(now(), "%H%M")) | eval blackout= if((myHourMin>2100),"YES","NO") | eval earliestMaybe=if((blackout=="NO"), info_min_time, now()) | map search="search earliest=$earliestMaybe$ latest=$info_max_time$ YOUR SEARCH HERE"

For the time range that it is not supposed to run, the search will generate an error.

Here are other similar questions with answers that should work for you (this answer is derived from the first one):

http://answers.splunk.com/answering/260370/view.html

http://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html