Alerting

How to throttle alert until 23:59:59 of the day?

morethanyell
Builder

So, we have this alert that's running every 5 minutes. Once the trigger logic is met, it will send an email. From thereon, we want that alert to stop and resume by 00:00:00 of the following day.

How do we do that? Thanks a lot!

0 Karma

valiquet
Contributor

Throttle on mytime

| eval mytime=strftime(_time, "%Y%m%d")

0 Karma

sudosplunk
Motivator

@morethanyell, Can you share the search you're using for alert, trigger logic.

0 Karma

kishor_pinjark2
Path Finder

Sorry I don't have any now.

As per answer from - https://answers.splunk.com/answers/403320/how-do-i-suppress-alerts-until-the-next-day-at-12.html

Original Alert - | rest /services/licenser/usage | eval "% used"=round(slaves_usage_bytes/quota*100,2) | where '% used' > 75 | fields "% used", "updated"

Updated Alert - | rest /services/licenser/usage | eval "% used"=round(slaves_usage_bytes/quota*100,2) | appendcols [search index=_internal sourcetype=scheduler thread_id=AlertNotifier* savedsearch_name="PUTYOURALERTSEARCHNAMEHERE" earliest=@d | head 1 | table _time] | where '% used' > 75 AND isnull(_time)| fields "% used", "updated"

Paste your query here, I will try...

0 Karma

sudosplunk
Motivator

My comment was to the poster of the question, @morethanyell 🙂 Thanks though!

0 Karma

kishor_pinjark2
Path Finder

My Bad...
Thanks...

0 Karma

kishor_pinjark2
Path Finder
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...