https://community.splunk.com/t5/Alerting/Customize-time-for-alerts/m-p/34687#M366 <P>Hello </P> <P>I have a alert running for every 5 mins to check the service status and alert when it's STOPPED. Everyday from 3:15 to 4:15 all the services will be STOPPED. Is there anyway that I can make that search not to run for that 1 hour and stop sending emails. As we all know that services will be down for sure in that 1 hour period we don't need to get alerted for that 1 hour. </P> <P>Any ideas</P> Wed, 15 May 2013 15:18:36 GMT theouhuios 2013-05-15T15:18:36Z https://community.splunk.com/t5/Alerting/Customize-time-for-alerts/m-p/34687#M366 <P>Hello </P> <P>I have a alert running for every 5 mins to check the service status and alert when it's STOPPED. Everyday from 3:15 to 4:15 all the services will be STOPPED. Is there anyway that I can make that search not to run for that 1 hour and stop sending emails. As we all know that services will be down for sure in that 1 hour period we don't need to get alerted for that 1 hour. </P> <P>Any ideas</P> Wed, 15 May 2013 15:18:36 GMT https://community.splunk.com/t5/Alerting/Customize-time-for-alerts/m-p/34687#M366 theouhuios 2013-05-15T15:18:36Z https://community.splunk.com/t5/Alerting/Customize-time-for-alerts/m-p/34688#M367 <P>Hi Theo</P> <P>If your server was down for a clean hour, it would be a simple task to use cron to schedule it. For example the following would work every 5 mins from midnight to 2:55 and then 4:00 onwards. </P> <PRE><CODE>*/5 0-2,4-24 * * * </CODE></PRE> <P>For your timing, this is not so simple. I would normally use the <CODE>date_hour</CODE> and <CODE>date_minute</CODE> fields to calculate the time but your report may not have them. What you could do is modify the search by adding the following at the end of the search.</P> <P><CODE>| eval timeInMin=(now()-relative_time(now(), "@d"))/60 | where (timeInMin &lt; 3*60+14) OR (timeInMin &gt; 4*60+16)| fields - timeInMin</CODE></P> <P>This would delete any results if the time was between 3:15 and 4:15. If this doesn't work, please tell us how you have your alert set up.</P> Wed, 15 May 2013 20:16:31 GMT https://community.splunk.com/t5/Alerting/Customize-time-for-alerts/m-p/34688#M367 BobM 2013-05-15T20:16:31Z