Alerting

How create a schedule alert just after 17:00, holidays and weekend?

jfeitosa
Path Finder

I need to schedule an alert that triggers an email alert just after 17:00, holidays and weekend. It's possible?

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

View solution in original post

jfeitosa
Path Finder

OK, thanks guys for the help. I think that create a list of the holidays is a good idea.

0 Karma

gcusello
Legend

To execute search only in week end you can use cron (setting 0 17 * * 6,7).
To manage holidays you have to create a lookup with all your year holidays and manage it in your search.
Bye.
Giuseppe

0 Karma

sundareshr
Legend

How about something like this. You will need to create a lookup table with list of holidays. Schedule this to run at midnight and at 5 PM and set a throttle in your alert for 234hrs. So, if the holiday or weekend fires, the 5:00pm will not trigger.

| gentimes start=-1 | eval t=now() | eval today=strftime(t, "format to match lookup field") | lookup csvfilewithlistofholidays.csv datefield AS today OUTPUT holidayflag | eval dow=strftime(dow(), "%a") | eval weekendflag=if(dow="Sun" OR dow="Sat", "YES", null()) | eval timeflag=if(strftime(now(), "%H")=17 AND strftime(now(), "%M")<=5 | where timeflag="YES" OR holidayflag="YES" OR weekendflag="YES"

richgalloway
SplunkTrust
SplunkTrust

Weekends are easy. Use the following cron setting 0 17 * * 6,7.
Holidays are not possible, IMO. In Linux, one could create a crontab with all holidays in it, but there is no such thing in Splunk. Splunk limits us to a single cron string.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...