Alerting

Suppress Splunk alert for specific field value and for specific scheduled window

Hi Team,

I would like to suppress the splunk alert for specific duration every day for 2 hrs ( for instance 9 am to 11 am) every day on a specific field value. With throttle, I can't set for specific time range, will I have to modify the query?

Quick help would be appreciated!

Labels (1)
Tags (2)
0 Karma

Communicator

For advanced evaluation like that you will probably need to do it within the search itself. You can use time functions to evaluate the current hour, and then add temporary fields to evaluate and further filter the search against. This may not be the most elegant solution, but I think it works. The important lines being the creation of the "smallHand" hour field; using it to set the filter field; and then applying the where filter.

| makeresults
| eval smallHand=strftime(now(), "%H"), field1="abc;def;ghi", field2="Lorem ipsum dolor sit amet"
| makemv field1 delim=";"
| mvexpand field1
| eval smallHand=if(field1="def" OR field1="ghi", "10", smallHand)
| eval filter=if(smallHand>=9 AND smallHand<11 AND field1="def", "True", "False")
| where filter!="True"
| fields - filter, smallHand
0 Karma

SplunkTrust
SplunkTrust
0 Karma

I know about the cron expression, I am looking for suppression of alerts for the specific scheduled time.

0 Karma

SplunkTrust
SplunkTrust
0-9,11-24

Is this enough?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!