Alerting

How create a schedule alert just after 17:00, holidays and weekend?

jfeitosa
Path Finder

I need to schedule an alert that triggers an email alert just after 17:00, holidays and weekend. It's possible?

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

View solution in original post

jfeitosa
Path Finder

OK, thanks guys for the help. I think that create a list of the holidays is a good idea.

0 Karma

gcusello
Legend

To execute search only in week end you can use cron (setting 0 17 * * 6,7).
To manage holidays you have to create a lookup with all your year holidays and manage it in your search.
Bye.
Giuseppe

0 Karma

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

richgalloway
SplunkTrust
SplunkTrust

Weekends are easy. Use the following cron setting 0 17 * * 6,7.
Holidays are not possible, IMO. In Linux, one could create a crontab with all holidays in it, but there is no such thing in Splunk. Splunk limits us to a single cron string.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...