How to throttle alert until 23:59:59 of the day?

[morethanyell]

So, we have this alert that's running every 5 minutes. Once the trigger logic is met, it will send an email. From thereon, we want that alert to stop and resume by 00:00:00 of the following day.

How do we do that? Thanks a lot!

[valiquet]

Throttle on mytime

| eval mytime=strftime(_time, "%Y%m%d")

[sudosplunk]

@morethanyell, Can you share the search you're using for alert, trigger logic.

[kishor_pinjark2]

Sorry I don't have any now.

As per answer from - https://answers.splunk.com/answers/403320/how-do-i-suppress-alerts-until-the-next-day-at-12.html

Original Alert - | rest /services/licenser/usage | eval "% used"=round(slaves_usage_bytes/quota*100,2) | where '% used' > 75 | fields "% used", "updated"

Updated Alert - | rest /services/licenser/usage | eval "% used"=round(slaves_usage_bytes/quota*100,2) | appendcols [search index=_internal sourcetype=scheduler thread_id=AlertNotifier* savedsearch_name="PUTYOURALERTSEARCHNAMEHERE" earliest=@d | head 1 | table _time] | where '% used' > 75 AND isnull(_time)| fields "% used", "updated"

Paste your query here, I will try...

[sudosplunk]

My comment was to the poster of the question, @morethanyell 🙂 Thanks though!

[kishor_pinjark2]

My Bad...
Thanks...

[kishor_pinjark2]

See below answer:

https://answers.splunk.com/answers/403320/how-do-i-suppress-alerts-until-the-next-day-at-12.html