alert setup


I would like to setup 2 alerts whenever no hits during the period . one is peak hours from 6am-01am and another one is non peak hours 01am-6am 

each alert should trigger every 30 mins during these period .

Labels (1)
0 Karma


Hi @koushik,

let me understand: why do you want two alerts if you have to check that you haven't logs in a period?

you could have two alerts if you have a different threeshold in the two periods, but you have to check only if there are logs, so I think that you don't need two alerts.

Anyway, if you want two alerts, you have to follow two times this procedure:

  • create the search using the timeframe you want in the alert (e.g. 30 minutes),
  • Save as - Alert
  • add the following infos:
    • Title - mnemonic name of your alert,
    • Description (optional) - a description of your alert to remember it,
    • Permission: shared in App - kind of permission of your alert,
    • Alert Type: Scheduled - don't use real time because it't too expensive in terms of resources
    • Run on cron schedule - scheduling the alert execution
    • Time range - 30 minutes
    • Cron expression: */30 * * * * - it means run every 30 minuts
    • Expires 24 hours - time that the search results are available
    • trigger aler when Number of results - trigger condition
    • is equal to 0 - trigger if no results
    • trigger once - only one alert
    • Trigger actions: Add alert - add the actions to associate to you alert (email, script, etc...), add always the "Add to triggered alerts" action
    • Save

If you want two alerts, the only difference between them is the cron expression and/or eventually the message in the eMail:

  • */30 1-6 * * *
  • */30 7-24 * * *



Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...