Alerting

date diff until

DaveBunn
Path Finder

I have an alert which detects when a log feed has failed

The team the alert goes to have asked that I allow them to suppress the alert.

I have now created a mailto link within the alert email that sends and email with a specifically crafted email subject and body that is detected in all future alerts to suppress future alerts for 12hrs.
a simple math calculation generates the 12hrs, the epoch timestamp is in the subject header, the alert spl looks at the subject and either suppresses the alert or not.

This works perfectly - the technical team have now asked that I vary the suppression as follows

If the alert came in before 10AM the suppression remains 12 hours
If the alert came in after 10AM then the suppression time would be "until 10AM the following day".

So - how do you calculate a time stamp to 10AM the following day.
It must be simple but my mind has lost it right now.
Something like is current hour >10AM timestamp=tomorrow:10Hrs

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

DaveBunn
Path Finder

Thanks Rich - logical when you think about it.

Works a treat - thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the relative_time function to calculate time offsets.

| eval new_time = relative_time(now(), "+1d@d+10h")

The format string breaks down as follows:

"+1" : this time tomorrow
"@d": round off the time to 0:00
"+10h": add ten hours

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...