Hi, I have an alert which runs every 15 minutes as of now but what i want is to NOT trigger from 1:30 AM to 2:30 AM everyday. That's the time when my server cache gets flushed and the spike in the response time is usual. So I don't want to trigger the alert at this time.
Due to this we are getting false alarms.
How do i achieve this. My query is -
index=test sourcetype=access_combined_wcookie POST requested_content=/checkout/your-order* | timechart span=15m avg(response_time_sec) as AvgResponseTime by host | eval AvgResponseTime=round(AvgResponseTime,3)
you need to schedule same search multiple times with different cron jobs
*/15 0,3-23 * * *
The above schedules job except below schedules
1 , 1:15,[1:30,1:45,2,2:15,2:30],2:45
you need only three schedules from above except the ones enclosed in 
one cron is not possible to schedule job to run at 1,1:15 , 2:45 , you need two to achieve this.
so you will need total 3 different cron schedules as below
*/15 0,3-23 * * * 00,15 1 * * * 45 2 * * *