https://community.splunk.com/t5/Alerting/How-to-blackout-the-alerts/m-p/292889#M5351 <P>You could create a blackout macro and add it once to every alert search code. </P> <P>woodcock has posted a version of the code in several places -- (search for blackout and cron together and you'll find a bunch of them__ here's a few links... </P> <UL> <LI><A href="https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html">https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html</A></LI> <LI><A href="https://answers.splunk.com/answers/294186/how-to-create-a-splunk-alert-and-schedule-it-to-by.html">https://answers.splunk.com/answers/294186/how-to-create-a-splunk-alert-and-schedule-it-to-by.html</A></LI> </UL> <P>His version intentionally generates errors when the search runs during a blackout, but I modified it to a version that just quietly returns no results here...</P> <UL> <LI><A href="https://answers.splunk.com/answers/261163/is-there-a-way-i-can-schedule-a-saved-search-to-ru.html#answer-260370">https://answers.splunk.com/answers/261163/is-there-a-way-i-can-schedule-a-saved-search-to-ru.html#answer-260370</A></LI> </UL> <P>The basic method for this silenced version is to add a subsearch that figures out whether you are running in a blackout window, and if so, adds a ridiculous search term that will never be found. That makes it certain that there will be zero records returned, and it should be pretty quick in doing so. </P> <PRE><CODE> YOUR SEARCH HERE [ | noop | stats count AS search | eval search=if(((tonumber(strftime(now(),"%W"))%2)==1),"SomeLongStringHereWhichWillNeverBeFoundInBloomFilters","")] | YOUR PROCESSING HERE </CODE></PRE> <P>Note the preceding example happened to be for a cron that ran once per week, but which really only wanted to run on alternate weeks. Thus, week number odd/even test was the method of deciding blackouts. Replace <CODE>((tonumber(strftime(now(),"%W"))%2)==1)</CODE> with a test that returns <CODE>true()</CODE> during your blackouts and <CODE>false()</CODE> at all other times.</P> <HR /> <P>You may need to develop a similar but inverse method for any alert which is designed to complain when there are zero records returned...such as for when a host stops reporting. The format of that will depend on the typical architecture of your alerts. If you need that, then please open a new question, post an example of your alert that you need to hush during blackouts, and the community will be able to help you with a version that does what you need.</P> Thu, 23 Mar 2017 20:09:52 GMT DalJeanis 2017-03-23T20:09:52Z https://community.splunk.com/t5/Alerting/How-to-blackout-the-alerts/m-p/292888#M5350 <P>Is there a way to blackout all the alerts in Splunk during the maintenance window all at one go in Splunk Cloud</P> Thu, 23 Mar 2017 18:28:29 GMT https://community.splunk.com/t5/Alerting/How-to-blackout-the-alerts/m-p/292888#M5350 srisplunk12 2017-03-23T18:28:29Z https://community.splunk.com/t5/Alerting/How-to-blackout-the-alerts/m-p/292889#M5351 <P>You could create a blackout macro and add it once to every alert search code. </P> <P>woodcock has posted a version of the code in several places -- (search for blackout and cron together and you'll find a bunch of them__ here's a few links... </P> <UL> <LI><A href="https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html">https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html</A></LI> <LI><A href="https://answers.splunk.com/answers/294186/how-to-create-a-splunk-alert-and-schedule-it-to-by.html">https://answers.splunk.com/answers/294186/how-to-create-a-splunk-alert-and-schedule-it-to-by.html</A></LI> </UL> <P>His version intentionally generates errors when the search runs during a blackout, but I modified it to a version that just quietly returns no results here...</P> <UL> <LI><A href="https://answers.splunk.com/answers/261163/is-there-a-way-i-can-schedule-a-saved-search-to-ru.html#answer-260370">https://answers.splunk.com/answers/261163/is-there-a-way-i-can-schedule-a-saved-search-to-ru.html#answer-260370</A></LI> </UL> <P>The basic method for this silenced version is to add a subsearch that figures out whether you are running in a blackout window, and if so, adds a ridiculous search term that will never be found. That makes it certain that there will be zero records returned, and it should be pretty quick in doing so. </P> <PRE><CODE> YOUR SEARCH HERE [ | noop | stats count AS search | eval search=if(((tonumber(strftime(now(),"%W"))%2)==1),"SomeLongStringHereWhichWillNeverBeFoundInBloomFilters","")] | YOUR PROCESSING HERE </CODE></PRE> <P>Note the preceding example happened to be for a cron that ran once per week, but which really only wanted to run on alternate weeks. Thus, week number odd/even test was the method of deciding blackouts. Replace <CODE>((tonumber(strftime(now(),"%W"))%2)==1)</CODE> with a test that returns <CODE>true()</CODE> during your blackouts and <CODE>false()</CODE> at all other times.</P> <HR /> <P>You may need to develop a similar but inverse method for any alert which is designed to complain when there are zero records returned...such as for when a host stops reporting. The format of that will depend on the typical architecture of your alerts. If you need that, then please open a new question, post an example of your alert that you need to hush during blackouts, and the community will be able to help you with a version that does what you need.</P> Thu, 23 Mar 2017 20:09:52 GMT https://community.splunk.com/t5/Alerting/How-to-blackout-the-alerts/m-p/292889#M5351 DalJeanis 2017-03-23T20:09:52Z