https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243488#M72465 <P>You should modify the search so it does not match events which fall under the maint window using a combination of the date_wday and date_hour and if it's on specific days every month then date_mday. </P> <P>Ex, a maint window every sunday from 00:00:00 to 02:00:00, you could use "date_wday!=sunday AND (date_hour!=0 OR date_hour!=1)"</P> <P>Another idea would be to put your maintenance schedule into a lookup CSV, either as their epoch times or a "normal" timestamp you'll have to convert with strptime. Then just filter out events with times which match those ranges in the search. </P> Tue, 29 Sep 2020 12:30:13 GMT goodsellt 2020-09-29T12:30:13Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243485#M72462 <P>Hello -</P> <P>I have an alert setup that I need to not fire on Sundays between 2:45pm and 4:00pm. Below is what I have configured. I'm getting alerts during the maintenance window. I could use a second set of eye to help spot what I have set wrong.</P> <PRE><CODE>index=hdx_was source="/hdx1/was70-32/AppServer/profiles/AppSrv01/logs/PRD3_XF*/SystemOut.log" "A connection failed but has been re-established" | eval wday=strftime(now(),"%a"),homi=strftime(now(),"%H%M"),dactivate=if(wday="Sun" AND homi&gt;=1445 AND homi&lt;=1600,"off",NULL) </CODE></PRE> <P>Thanks</P> Thu, 19 Jan 2017 15:26:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243485#M72462 cj039165 2017-01-19T15:26:01Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243486#M72463 <P>What is your alert condition? Do you alert on "number of events greater than 0" type or any custom condition?</P> Thu, 19 Jan 2017 17:05:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243486#M72463 somesoni2 2017-01-19T17:05:33Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243487#M72464 <P>It's currently set to 'per result'</P> Thu, 19 Jan 2017 17:10:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243487#M72464 cj039165 2017-01-19T17:10:49Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243488#M72465 <P>You should modify the search so it does not match events which fall under the maint window using a combination of the date_wday and date_hour and if it's on specific days every month then date_mday. </P> <P>Ex, a maint window every sunday from 00:00:00 to 02:00:00, you could use "date_wday!=sunday AND (date_hour!=0 OR date_hour!=1)"</P> <P>Another idea would be to put your maintenance schedule into a lookup CSV, either as their epoch times or a "normal" timestamp you'll have to convert with strptime. Then just filter out events with times which match those ranges in the search. </P> Tue, 29 Sep 2020 12:30:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243488#M72465 goodsellt 2020-09-29T12:30:13Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243489#M72466 <P>I see you calculated dactivate variable but not using it to filter results. I would just below to your current search.</P> <PRE><CODE>your current search | where isnull(deactivate) </CODE></PRE> <P>So if the alert ran on maintenance window, dactivate field will have value "off" and the search will not return any results.</P> Thu, 19 Jan 2017 17:32:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-alert-to-turn-it-off-during-a-known-maintenance/m-p/243489#M72466 somesoni2 2017-01-19T17:32:06Z