topic How to Black out my splunk alert for particular period ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354126#M162291 <P>How to Black out my splunk alert for particular period?</P> <P>There are two different scenarios<BR /> firest alert:</P> <P>1)16:30 ET Saturday to 00:30 ET Monday on all weekends ---&gt;black out time</P> <P>index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount &gt;5</P> <P>Second alert:<BR /> 00:00 to 08:00 ET on weekdays and 20:00 to 08:00 ET on weekends ---&gt;black out time</P> <P>index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount &gt;5</P> Tue, 29 Sep 2020 18:29:55 GMT karthi2809 2020-09-29T18:29:55Z How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354126#M162291 <P>How to Black out my splunk alert for particular period?</P> <P>There are two different scenarios<BR /> firest alert:</P> <P>1)16:30 ET Saturday to 00:30 ET Monday on all weekends ---&gt;black out time</P> <P>index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount &gt;5</P> <P>Second alert:<BR /> 00:00 to 08:00 ET on weekdays and 20:00 to 08:00 ET on weekends ---&gt;black out time</P> <P>index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount &gt;5</P> Tue, 29 Sep 2020 18:29:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354126#M162291 karthi2809 2020-09-29T18:29:55Z Re: How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354127#M162292 <P>Foe weekend you want 20:00 to 08:00 ET on weekends this or 16:30 ET Saturday to 00:30 ET Monday on all weekends?</P> Thu, 15 Mar 2018 06:49:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354127#M162292 p_gurav 2018-03-15T06:49:37Z Re: How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354128#M162293 <P>Hi p_gurav</P> <P>mentioned two alert scenarios</P> Thu, 15 Mar 2018 06:54:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354128#M162293 karthi2809 2018-03-15T06:54:48Z Re: How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354129#M162294 <P>How frequently this alerts are running? You can do this black out thing with <CODE>cron</CODE> schedule, but to help you with that I need alert frequency.</P> Thu, 15 Mar 2018 07:39:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354129#M162294 p_gurav 2018-03-15T07:39:34Z Re: How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354130#M162295 <P>every 30 min</P> Thu, 15 Mar 2018 09:07:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354130#M162295 karthi2809 2018-03-15T09:07:36Z Re: How to Black out my splunk alert for particular period ? https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354131#M162296 <P>Hi,</P> <P>Apparently it's not possible to put all condition in 1 cron schedule, you have to create 4 separate alert with below suggested cron.</P> <OL> <LI><P>16:30 ET Saturday to 00:30 ET Monday on all weekends :</P> <P>Cron : */30 * * * 1,2,3,4,5<BR /> : */30 0-16 * * 6</P></LI> <LI><P>00:00 to 08:00 ET on weekdays and 20:00 to 08:00 ET on weekends<BR /> Cron : */30 9-23 * * 1,2,3,4,5<BR /> : */30 8-19 * * 0,6</P></LI> </OL> Thu, 15 Mar 2018 10:39:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-Black-out-my-splunk-alert-for-particular-period/m-p/354131#M162296 p_gurav 2018-03-15T10:39:17Z