Alerting

How to create a Splunk alert and schedule it to bypass a particular time range by using a cron schedule?

tkmads1
Explorer

I want to create a splunk alert and schedule it in such a way that it should bypass the particular timeframe (e.g it should not run between 9 PM to 12 AM).

How can do it?

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Use Cron.

1 1-20 * * * 

That will work for all hours from 1AM - 8PM. I typically don't start things at the top of the hour to avoid resource contention with other hourly crons that may be installed on the system.

Edit: I double checked the syntax and had forgotten that a range can work as well.

View solution in original post

woodcock
Esteemed Legend

You can short-circuit the job during the blackout period by using addinfo and map for the blackout period that it is not supposed to run like this (extra steps for clarity):

| noop | stats count AS myHourMin | addinfo | eval myHourMin=tonumber(strftime(now(), "%H%M")) | eval blackout= if((myHourMin>2100),"YES","NO") | eval earliestMaybe=if((blackout=="NO"), info_min_time, now()) | map search="search earliest=$earliestMaybe$ latest=$info_max_time$ YOUR SEARCH HERE"

For the time range that it is not supposed to run, the search will generate an error.

Here are other similar questions with answers that should work for you (this answer is derived from the first one):

http://answers.splunk.com/answering/260370/view.html

http://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-wh...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Use Cron.

1 1-20 * * * 

That will work for all hours from 1AM - 8PM. I typically don't start things at the top of the hour to avoid resource contention with other hourly crons that may be installed on the system.

Edit: I double checked the syntax and had forgotten that a range can work as well.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...