Alerting

Alert for monthly reporting

Kwip
Contributor

How to set the alert to run from 26 of last month to 25 of current month. Say example,
Every month at day 1 I will run monthly report, for the run on December month the period should be 26th of October to 25th of November.

Please guide on the same.

0 Karma
1 Solution

hardikJsheth
Motivator

You can set the earliest and latest time as per your requirement and run it on specific schedule. For running search query over period of 26th day to 25th day you can set the time as follows:

earliest : -2mon@mon+25d
latest: -mon@mon+25d

For further information refer http://docs.splunk.com/Documentation/Splunk/7.0.0/Search/Specifytimemodifiersinyoursearch.

View solution in original post

hardikJsheth
Motivator

You can set the earliest and latest time as per your requirement and run it on specific schedule. For running search query over period of 26th day to 25th day you can set the time as follows:

earliest : -2mon@mon+25d
latest: -mon@mon+25d

For further information refer http://docs.splunk.com/Documentation/Splunk/7.0.0/Search/Specifytimemodifiersinyoursearch.

Kwip
Contributor

@hardikJsheth

Awesome! This is what I was looking for! Thank you!

0 Karma

kunalmao
Communicator

To start with , alert and report are two different knowledge objects in Splunk. An alert will be generated only when specific condition like number of results etc are met. Where as a report is the result of your query and can be viewed similar to a dashboard, it can also be scheduled as mail and the results will be mailed to you.

Assuming your question is about alerts, there are two ways in which you can set it up.

  • Run the query for the desired time range (in your case the complete month) and then on the top right corner of search bar click on save as alert and in that you will be required to give the schedule viz is when you want splunk to run the query for you (in your case 1st of every month)
  • Alternatively you can go to settings -> Searches, reports, and alerts in that new alert and provide the same info. Here also time range is your range for which you want splunk to run query and schedule is when you want it to run.

Coming to reports create the report in the same way, once you have created the report , find it in settings -> Searches, reports, and alerts and click on edit and schedule the report to run on the specific time you want it to run

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...