Solved: Re: How do you create and schedule a daily alert t... - Splunk Community

Alerting

I want to create and schedule an alert to run at 1am daily that extracts event from yesterday 0:00am to yesterday 23:59pm.

How do I do this?

1 Solution

Solution

When you define your alert, set earliest=-1d@d, latest=@d, and cron schedule to "0 1 * * *"

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Solution

When you define your alert, set earliest=-1d@d, latest=@d, and cron schedule to "0 1 * * *"

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...