topic Re: How to disable splunk alert for a specific time frame? in Splunk Search

How to disable splunk alert for a specific time frame?

rzv424 — Mon, 19 Feb 2024 11:44:18 GMT

We want an alert to run every day (Monday-Sunday) on a 30 minutes interval with one exception. The exception is it should not run specifically on Wednesday and Friday from 5AM to 8AM. However it should run on other hours on Wednesday and Friday as well (apart from 5AM to 8AM)

One cron is not able to achieve that. Hence want to change in the alert logic.

Re: How to disable splunk alert for a specific time frame?

ITWhisperer — Mon, 19 Feb 2024 11:50:16 GMT

You have two options:

Duplicate the alert and use a different cron expression for the different days/time periods
Use now() function to determine when the search is running and modify the results so that the alert isn't triggered.

Re: How to disable splunk alert for a specific time frame?

subham29 — Mon, 19 Feb 2024 12:06:40 GMT

@rzv424
Solution1:

You can create two alerts with the same logic with different CRONs.

1st alert CRON will run every day except on Wed and Fri. Cron is: */30 * * * 0,1,2,4,6
Second alert CRON will run every 30 minutes on Wednesday and Friday and will stop from 5AM to 8AM. Cron is: */30 0-5,8-23 * * 3,5

Solution2:

You can create one alert with a CRON to run every day of the week at 30 minutes interval, Cron is */30 * * * *

And you can add the filtering at the logic of query itself:
Use an EVAL command to output the current day and hour after your logic ends. and then filter or don't show your outputs as per your exception requirement

......| eval now_day=strftime(now(), "%a"), now_hour=strftime(now(), "%H")
| search NOT ((now_day="Wed" AND (now_hour="5" OR now_hour="6" OR now_hour="7" OR now_hour="8")) OR (now_day="Fri" AND (now_hour="5" OR now_hour="6" OR now_hour="7" OR now_hour="8")))