Alerting

How to ignore or skip a particular timing in Splunk alert

shashank_24
Path Finder

Hi, I have an alert which runs every 15 minutes as of now but what i want is to NOT trigger from 1:30 AM to 2:30 AM everyday. That's the time when my server cache gets flushed and the spike in the response time is usual. So I don't want to trigger the alert at this time.

Due to this we are getting false alarms.

How do i achieve this. My query is -

 

 

 

index=test sourcetype=access_combined_wcookie POST requested_content=/checkout/your-order* 
| timechart span=15m avg(response_time_sec) as AvgResponseTime by host 
| eval AvgResponseTime=round(AvgResponseTime,3)

 

 

 

 

Labels (2)
0 Karma

thambisetty
Super Champion

you need to schedule same search multiple times with different cron jobs

*/15 0,3-23 * * *  

The above schedules job except below schedules

1 , 1:15,[1:30,1:45,2,2:15,2:30],2:45

you need only three schedules from above except the ones enclosed in []

one cron is not possible to schedule job to run  at 1,1:15 , 2:45 , you need two to achieve this.

so you will need total 3 different cron schedules  as below

*/15 0,3-23 * * *  

00,15 1 * * * 

45 2 * * *

 

————————————
If this helps, give a like below.
0 Karma

shashank_24
Path Finder

@thambisetty Ok it make sense. So even if i want to just exclude the time from 02:00 to 02:30 then also I would have to create multiple crons/searches. Right?

0 Karma

thambisetty
Super Champion

@shashank_24 

yes, you are right.

————————————
If this helps, give a like below.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>