https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420457#M7335 <P>You can create a one-time cron job to call the CLI to enable a particular search, or even directly modify the <CODE>savedsearches.conf</CODE> file.</P> Sat, 20 Apr 2019 13:13:05 GMT woodcock 2019-04-20T13:13:05Z https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420455#M7333 <P>Sometimes (like on holidays), I want to disable an alert for a period of time so that it doesn't fire and cause operators to panic. Usually, we do one of two things:</P> <OL> <LI>Manually disable the alert on the day we want it to stop running, then manually re-enable it as soon as we want it to run again. This often requires waiting until the end of the day before a holiday, then coming in as soon as possible the following work day and remembering to re-enable everything.</LI> <LI>Tweak the cron schedule so the search doesn't run on the days of the week the holidays fall on. This is less transparent and still requires someone to manually alter the alert's schedule.</LI> </OL> <P>I'm wondering if there's a better solution, maybe something like a snooze function where we can say ahead of time that we don't want the alert to run on days x, y, z, but then resume normal functionality. This would be more like a planned outage than reactive throttling. </P> Fri, 19 Apr 2019 14:39:05 GMT https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420455#M7333 mbavlsik 2019-04-19T14:39:05Z https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420456#M7334 <P>Unfortunately there is no snooze facility. It has been a long running feature request.</P> Sat, 20 Apr 2019 06:55:55 GMT https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420456#M7334 burwell 2019-04-20T06:55:55Z https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420457#M7335 <P>You can create a one-time cron job to call the CLI to enable a particular search, or even directly modify the <CODE>savedsearches.conf</CODE> file.</P> Sat, 20 Apr 2019 13:13:05 GMT https://community.splunk.com/t5/Alerting/How-to-snooze-or-temporarily-disable-scheduled-searches/m-p/420457#M7335 woodcock 2019-04-20T13:13:05Z