Need to stop Splunk triggering alert for a specific period of time

[sureshkumaar]

I got a requirement where i want to stop the alerts to be triggering during these two maintenance window from July 2 2020 8 PM to July 6 2020 6 AM.

[gcusello]

sorry, I had a wrong click!

otherwise, you can insert in your search a condition that gives no results in the maintenance period.

Ciao.

Giuseppe

[gcusello]

Hi @sureshkumaar ,

you can disable it from the "Searches, Reports and Alerts" dashboard.

Then enable it again when you'll finish your maintenance.

Ciao.

Giuseppe

[sureshkumaar]

Hi @gcusello - Is there any option than doing it manually???

[gcusello]

Hi @sureshkumaar ,

find in [Settings -- Searches, Reports, and Alers] your alert (eventually using the filters on the top),

then click on Edit and Disable/Enable it.

Ciao.

Giuseppe