To reset/delete the alerts at configurable time.

New Member

With built-in functionality of splunk, we can set the alert expiration time to 6hrs, 12hrs etc.
But is there a way to delete all the alerts raised during a day at particular time and can we keep that time configurable?
e.g. I want to reset/delete all the alerts raised during a day at 23:59:59, how can this be achieved?

0 Karma

0 Karma

Path Finder


As per a Business requirement, we want to be able to automatically delete all Alerts triggered on the previous Business Day, at the start of each Business Day. For eg. at the start of the current day, let us say 9th June 00:01:00, we want to delete all the triggered alerts triggered between 8th June 00:00:00 to 8th June 23:59:59.

Could you please let us know if this could be the correct way of doing it? The following query works, but we do not know the impact it could have, or if it is correct to use it.

index=_audit earliest=-1d@d latest=@d action=alert_fired ss_app= | delete

0 Karma

New Member

Thank you for the answer but, i don't need to disable the alerts in the particular window but, need to delete all the alerts raised (in triggered alerts window) within day at a particular configurable time.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...