Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Dashboard for a 1 week search only between cor...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Is there a way of returning alerts from a search query but only for between core working hours over a period of 7 days?
Essentially, I need a dashboard to return results for when Critical severity alerts have not been closed within 2 hours, but only for between the hours of 08:00 - 17:00. So basicly just a gauge to show a percentage of those alerts which missed the KPI.
Currently I have the following which appears to work, but I'm not sure how to only make it applicable for between 8 - 5.
| incident_review | where like(status_label,"Assigned-%") OR like(status_label,"Closed-%") | transaction rule_id | where eventcount>1 | fields time, duration, eventcount, owner, reviewer, rule_id, status, urgency | join rule_id [ search notable | rex field=eventtype "(?P\w+\\w+)-" | search NOT SpStatus="notable_suppression" | rename urgency as NT_urgency | fields rule_id, status, status_label, NT_urgency] | eval FinalUrgency=if(isnull(urgency),NT_urgency,urgency) | eval RTimeTaken=duration/60 | where status="2" AND (status="3" OR status="4" OR status="5") | eval TimeTaken=duration | search FinalUrgency=critical | eval QueueStatus=if(RTimeTaken<120,"Yes", "No") | stats count by QueueStatus | eventstats sum(count) as total | eval percent= round ( count*100/total,1) |where match(QueueStatus,"Yes") | gauge percent 0 80 90 100
I'd really appreciate any help with this!
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I dont really need it as an alert. It's purpose is not to fire an alert when somebody hasnt acknowledged an alert of a particular severity within a given timeframe, more as a dashboard to display a percentage of those alerts that have been missed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got you, check out this. Seems like they had a similar problem as you have right now:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect, just what I was looking for. Many thanks.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
