topic Splunk Alert from 6 am? in Alerting

Splunk Alert from 6 am?

karthi2809 — Fri, 10 Nov 2017 10:39:18 GMT

I have a scenario that the alert need to be triggered at 6 AM , But i will get the logs from 3 AM ? How to set earliest and latest time stamp for the scenario?
In other words it should run every 3hrs. Please help me on same ?

I set earliest :@d+3h and latest :@d+6h

Re: Splunk Alert from 6 am?

harsmarvania57 — Fri, 10 Nov 2017 12:09:14 GMT

Hi,

If I am understanding correctlty your schedule search will run at every 3 hours & at 00 minutes and fetch last 3 hours data, in that case earliest time will be -3h@h and latest time will be either now or @h

I hope this helps.

Thanks,
Harshil

Re: Splunk Alert from 6 am?

karthi2809 — Fri, 10 Nov 2017 13:08:06 GMT

Thanks,

But i need to set up alert which start from next day 6 am and continuously for every three hours .before that i dont want to alert trigger.

Re: Splunk Alert from 6 am?

nawneel — Fri, 10 Nov 2017 13:45:23 GMT

@karthi2809 data come at 0300 HRS and and you want to schedule alert from 0600 at every 3 hours. is that understanding correct ? if so , schedule your alerts from 0300 using CRON and run it for last 3 hours.

Re: Splunk Alert from 6 am?

harsmarvania57 — Fri, 10 Nov 2017 13:48:45 GMT

@karthi2809 Do you mean to say you want to search future data ?