how to create an alert for each working day before 8.00 AM. (tue- fri) summary from the past 24hr and Mon(3 days)?


Hello Team,

I need to send an alert on all working day at 8.00 AM with a time range of 24hrs except on Monday with a time range of 3 days. Will this be possible in our alert settings for the same SPL query but different time range. OR should we add in SPL query ?


Labels (1)
0 Karma


You could append a timeframe adjustment to your base search

<your base search> [| makeresults
| fields - _time
| addinfo
| eval day=strftime(info_max_time, "%w")
| eval period=if(day == 1, "-3d", "-1d")
| eval earliest=relative_time(info_max_time,period)
| eval latest=info_max_time
| fields earliest latest]

Here I have used the end time as the reference point, but you could do similar with info_min_time


Hi @gemrose,

You can setup two alerts with below cron settings and time ranges using the same SPL;

Cron -> 0 8 * * 1
TimeRange --> -3d

Other days;
Cron -> 0 8 * * 2-5 
TimeRange --> -24h



If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...