Alerting

How to use the check_alerting_schedule in Alert Schedule for Splunk for multiple schedule conditions?

mudragadak
New Member

Question on how to use the check_alerting_schedule for multiple schedule conditions.

I've setup
1. schedules.csv for different pools of servers that undergo maintenance (App1_Maintenance, App2_Maintenance, App1_Server_Maintenance, App2_Server_Maintenance)
2. schedule_hours.csv for 24/7 working of these applications
3. schedule_maintenance_windows.csv for App1_Maintenance between 09:00AM to 12:00PM. App1_Server_Maintenance between 12:00PM and 04:00PM. The following day, I have a DataCenter_Maintenance between 04:00AM and 06:00AM

Now, I can setup all application alerts with a check_alerting_schedule(App1_Maintenance) and all server alerts with a check_alerting_schedule(App1_Server_Maintenance).

But, logically, when my DataCenter or App1's server is under maintenance, the alert schedule should be checked against all App1_Maintenance, App1_Server_Maintenance and DataCenter_Maintenance schedules to silence the false alerts.

Is there a way that I can use multiple schedules to silence or enable alerts?

0 Karma

somesoni2
Revered Legend

Does schedule_id is same for all lookup files? (it's a primary key which should be same for all lookups)

0 Karma

mudragadak
New Member

nope..the schedule_id is the one that goes in as argument for check_alerting_schedule above.

0 Karma

somesoni2
Revered Legend

I'm reading the details on the app "Alert Schedule for Splunk" at below link and, in screenshot 3, it states that all lookup files should share same schedule_id value for all exclusion lookups.

https://splunkbase.splunk.com/app/3563/#/overview

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...