Dashboard for a 1 week search only between core working hours

[jacqu3sy]

Hi,

Is there a way of returning alerts from a search query but only for between core working hours over a period of 7 days?

Essentially, I need a dashboard to return results for when Critical severity alerts have not been closed within 2 hours, but only for between the hours of 08:00 - 17:00. So basicly just a gauge to show a percentage of those alerts which missed the KPI.

Currently I have the following which appears to work, but I'm not sure how to only make it applicable for between 8 - 5.

| incident_review | where like(status_label,"Assigned-%") OR like(status_label,"Closed-%") | transaction rule_id | where eventcount>1 | fields time, duration, eventcount, owner, reviewer, rule_id, status, urgency | join rule_id [ search notable | rex field=eventtype "(?P\w+\\w+)-" | search NOT SpStatus="notable_suppression" | rename urgency as NT_urgency | fields rule_id, status, status_label, NT_urgency] | eval FinalUrgency=if(isnull(urgency),NT_urgency,urgency) | eval RTimeTaken=duration/60 | where status="2" AND (status="3" OR status="4" OR status="5") | eval TimeTaken=duration | search FinalUrgency=critical | eval QueueStatus=if(RTimeTaken<120,"Yes", "No") | stats count by QueueStatus | eventstats sum(count) as total | eval percent= round ( count*100/total,1) |where match(QueueStatus,"Yes") | gauge percent 0 80 90 100

I'd really appreciate any help with this!

Thanks.

[omuelle1 · Accepted solution]

If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?

[jacqu3sy]

I dont really need it as an alert. It's purpose is not to fire an alert when somebody hasnt acknowledged an alert of a particular severity within a given timeframe, more as a dashboard to display a percentage of those alerts that have been missed.

[omuelle1]

Got you, check out this. Seems like they had a similar problem as you have right now:

https://answers.splunk.com/answers/69820/search-to-only-include-business-hours-and-exclude-weekends....

[jacqu3sy]

Perfect, just what I was looking for. Many thanks.