Alerting

How create a schedule alert just after 17:00, holidays and weekend?

jfeitosa
Path Finder

I need to schedule an alert that triggers an email alert just after 17:00, holidays and weekend. It's possible?

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

View solution in original post

jfeitosa
Path Finder

OK, thanks guys for the help. I think that create a list of the holidays is a good idea.

0 Karma

gcusello
SplunkTrust
SplunkTrust

To execute search only in week end you can use cron (setting 0 17 * * 6,7).
To manage holidays you have to create a lookup with all your year holidays and manage it in your search.
Bye.
Giuseppe

0 Karma

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Weekends are easy. Use the following cron setting 0 17 * * 6,7.
Holidays are not possible, IMO. In Linux, one could create a crontab with all holidays in it, but there is no such thing in Splunk. Splunk limits us to a single cron string.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.