Pause Alert for a backup window

[ICTMoretonbay]

I have a real time alert happily setup that looks for a specific condition in an index.
This alert triggers if said condition is met 5 times in 20 minutes.... its a rolling 20 minute window.
On alert , Splunk generates some notification emails and restarts windows services on a remote server.
All ok so far.....

My need is to stop this alert "looking" for the condition during the backup window... say daily 2100 to 0100.
Problem is the nature of the backup process induces the alert condition many times.

Can anyone help or advise on how to stop or pause this alert at the required time... for the required period?

[ICTMoretonbay]

Thanks for the fast response.
Ill amend the alert and give this a go.

Cheers

[elemenohpee]

You can achieve this with a cron schedule:

star/20 2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 star star star

obviously, stars are the symbol...

This schedule states that your search will fire every 20 minutes between 2am and 9pm, and will not fire outside those hours. You can then set your alert condition to be ‘if number of events is > 5’. This can be modified of course. Will that fit your use case?,You should be able to achieve this with a cron schedule: