https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438866#M124889 <P>I've been told not to use date_wday with stats due to some typical fringe cases where it's inaccurate. It's a calculated field after all.</P> <P>It would be better (again I'm told by the smarter folks) to eval the hour like this:</P> <PRE><CODE>| eval hour=strftime(_time,"%H") </CODE></PRE> <P>Then use the conditional logic on it.</P> Mon, 24 Jun 2019 13:41:17 GMT jkat54 2019-06-24T13:41:17Z https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438864#M124887 <P>My search condition is checking for results less than 10 every 45 minutes. The problem is we don't have that much traffic in the night to make it up to 10 searches. Is there an option to alert based on time of the day, for example trigger an alert if the number of searches is less than 10 between 09:00 to 18:00 and in the off hours trigger an alert if the number of searches is less than 3. </P> <P>I can write a separate splunk alert to cover off hours but wanted to check if there is an option to do this in the one alert.</P> Mon, 24 Jun 2019 09:52:49 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438864#M124887 anweshar 2019-06-24T09:52:49Z https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438865#M124888 <P>you can write an <CODE>eval</CODE> statement for example and alert on its results, example:<BR /> <CODE>... your search ... | eval bus_hours = if(date_hour&gt;=9 AND date_hour&lt;=18,"yes","no") ... <BR /> | eval alert = if(your_count &lt; 10 AND bus_hours = "yes","alert","not_alert) ...</CODE></P> <P>and now count the new <CODE>alert</CODE> field or configure your alert however you want</P> <P>hope it helps</P> Mon, 24 Jun 2019 12:20:09 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438865#M124888 adonio 2019-06-24T12:20:09Z https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438866#M124889 <P>I've been told not to use date_wday with stats due to some typical fringe cases where it's inaccurate. It's a calculated field after all.</P> <P>It would be better (again I'm told by the smarter folks) to eval the hour like this:</P> <PRE><CODE>| eval hour=strftime(_time,"%H") </CODE></PRE> <P>Then use the conditional logic on it.</P> Mon, 24 Jun 2019 13:41:17 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438866#M124889 jkat54 2019-06-24T13:41:17Z https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438867#M124890 <P>The <CODE>date_*</CODE> fields can be used IF they are there (there are not in every sourcetype/event); just be aware that they are interpreted to be in the timezome of the local event, not normalized to GMT/Zulu.</P> Mon, 24 Jun 2019 19:56:54 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-alert-to-be-triggered-based-on-time-of-the-day/m-p/438867#M124890 woodcock 2019-06-24T19:56:54Z