Alerting

How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule?

tkmads1
Explorer

I want to create a splunk alert and schedule it in such a way that it should bypass the particular timeframe (e.g it should not run between 9 PM to 12 AM).

How can do it?

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Use Cron.

1 1-20 * * * 

That will work for all hours from 1AM - 8PM. I typically don't start things at the top of the hour to avoid resource contention with other hourly crons that may be installed on the system.

Edit: I double checked the syntax and had forgotten that a range can work as well.

View solution in original post

woodcock
Esteemed Legend

You can short-circuit the job during the blackout period by using addinfo and map for the blackout period that it is not supposed to run like this (extra steps for clarity):

| noop | stats count AS myHourMin | addinfo | eval myHourMin=tonumber(strftime(now(), "%H%M")) | eval blackout= if((myHourMin>2100),"YES","NO") | eval earliestMaybe=if((blackout=="NO"), info_min_time, now()) | map search="search earliest=$earliestMaybe$ latest=$info_max_time$ YOUR SEARCH HERE"

For the time range that it is not supposed to run, the search will generate an error.

Here are other similar questions with answers that should work for you (this answer is derived from the first one):

http://answers.splunk.com/answering/260370/view.html

http://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-wh...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Use Cron.

1 1-20 * * * 

That will work for all hours from 1AM - 8PM. I typically don't start things at the top of the hour to avoid resource contention with other hourly crons that may be installed on the system.

Edit: I double checked the syntax and had forgotten that a range can work as well.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.