Alerting

Splunk Alert from 6 am?

karthi2809
Contributor

I have a scenario that the alert need to be triggered at 6 AM , But i will get the logs from 3 AM ? How to set earliest and latest time stamp for the scenario?
In other words it should run every 3hrs. Please help me on same ?

I set earliest :@d+3h and latest :@d+6h

Tags (2)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

If I am understanding correctlty your schedule search will run at every 3 hours & at 00 minutes and fetch last 3 hours data, in that case earliest time will be -3h@h and latest time will be either now or @h

I hope this helps.

Thanks,
Harshil

karthi2809
Contributor

Thanks,

But i need to set up alert which start from next day 6 am and continuously for every three hours .before that i dont want to alert trigger.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

@karthi2809 Do you mean to say you want to search future data ?

0 Karma

nawneel
Communicator

@karthi2809 data come at 0300 HRS and and you want to schedule alert from 0600 at every 3 hours. is that understanding correct ? if so , schedule your alerts from 0300 using CRON and run it for last 3 hours.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...