Alerting

Is there a way to exclude a specific day of the month from search results?

SplunkLunk
Path Finder

We do server updates the second Thursday of the month. So I don't want to alert on reboots when that occurs because I'll be inundated with false positives. Is there a way to exclude the second Thursday of every month from a search? Thanks in advance.

0 Karma

somesoni2
Revered Legend

You can do like this. The relative_time in where clause compare current time (the time when the search is running) with 2nd thursday of current month and excludes matching events.

your base search | where relative_time(now(),"@d")!=relative_time(now(),"@mon+2w@w4")
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!