Alerting

Disable splunk alert from 11PM to 2AM everyday AND from 3AM to 6AM Sunday?

HKLM
New Member

I want to stop getting alerted for specific events that happen which may be increased during maintenance times ( as I don't want to neglect only those alerts, , and I want to avoid them spamming my inbox)
(everyday 11PM-2AM) AND (Sunday 3AM-6AM)

Any advice on this?

Tags (1)
0 Karma
1 Solution

niketn
Legend

@HKLM One of the options would be use two separate crons (Following are once per hour, but you can increase frequency as per your needs):
1) Mon- Sat which runs from 02:00 AM to 23:00 PM: 0 2-23 * * 1-6
2) Sun from 00:00 AM to 03:00 AM and 06:00 AM to 23:00 PM: 0 0-3,6-23 * * 7

Other option would be to handle in your query based on default extracted time fieldsdate_wday and date_hour so that they do not return any events during blackout maintenance window: https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

You can definitely combine both approaches as well. So that Alert does not trigger in maintenance window and query also takes care of the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@HKLM One of the options would be use two separate crons (Following are once per hour, but you can increase frequency as per your needs):
1) Mon- Sat which runs from 02:00 AM to 23:00 PM: 0 2-23 * * 1-6
2) Sun from 00:00 AM to 03:00 AM and 06:00 AM to 23:00 PM: 0 0-3,6-23 * * 7

Other option would be to handle in your query based on default extracted time fieldsdate_wday and date_hour so that they do not return any events during blackout maintenance window: https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

You can definitely combine both approaches as well. So that Alert does not trigger in maintenance window and query also takes care of the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

HKLM
New Member

hi @niketn
thanks for your comment.
Can you clarify the 2nd option. I tried to read through the link you provided, it seems a different issue than mine, I have a query like this;
index="os" sourcetype=DBCon source IN ("os_netlogs") no endpoint listening at http://cic.cb.com/PartyLS_HTTPRout/port

0 Karma

HKLM
New Member

by the way the 2nd cron expression should be 0 0-3,6-23 * * 0

as Sunday is 0 not 7.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...