Suppress Splunk alert for specific field value and for specific scheduled window

[manish_singh_77]

Hi Team,

I would like to suppress the splunk alert for specific duration every day for 2 hrs ( for instance 9 am to 11 am) every day on a specific field value. With throttle, I can't set for specific time range, will I have to modify the query?

Quick help would be appreciated!

[anthonymelita]

For advanced evaluation like that you will probably need to do it within the search itself. You can use time functions to evaluate the current hour, and then add temporary fields to evaluate and further filter the search against. This may not be the most elegant solution, but I think it works. The important lines being the creation of the "smallHand" hour field; using it to set the filter field; and then applying the where filter.

| makeresults
| eval smallHand=strftime(now(), "%H"), field1="abc;def;ghi", field2="Lorem ipsum dolor sit amet"
| makemv field1 delim=";"
| mvexpand field1
| eval smallHand=if(field1="def" OR field1="ghi", "10", smallHand)
| eval filter=if(smallHand>=9 AND smallHand<11 AND field1="def", "True", "False")
| where filter!="True"
| fields - filter, smallHand

[to4kawa]

https://docs.splunk.com/Documentation/Splunk/latest/Alert/CronExpressions

[manish_singh_77]

I know about the cron expression, I am looking for suppression of alerts for the specific scheduled time.

[to4kawa]

0-9,11-24

Is this enough?