Is there a way of returning alerts from a search query but only for between core working hours over a period of 7 days?
Essentially, I need a dashboard to return results for when Critical severity alerts have not been closed within 2 hours, but only for between the hours of 08:00 - 17:00. So basicly just a gauge to show a percentage of those alerts which missed the KPI.
Currently I have the following which appears to work, but I'm not sure how to only make it applicable for between 8 - 5.
incident_review | where like(statuslabel,"Assigned-%") OR like(statuslabel,"Closed-%") | transaction ruleid | where eventcount>1 | fields _time, duration, eventcount, owner, reviewer, ruleid, status, urgency | join ruleid [ search
notable | rex field=eventtype "(?P\w+\\w+)-" | search NOT SpStatus="notablesuppression" | rename urgency as NTurgency | fields ruleid, status, statuslabel, NTurgency] | eval FinalUrgency=if(isnull(urgency),NTurgency,urgency) | eval RTimeTaken=duration/60 | where status="2" AND (status="3" OR status="4" OR status="5") | eval TimeTaken=duration | search FinalUrgency=critical | eval QueueStatus=if(RTimeTaken<120,"Yes", "No") | stats count by QueueStatus | eventstats sum(count) as total | eval percent= round ( count*100/total,1) |where match(QueueStatus,"Yes") | gauge percent 0 80 90 100
I'd really appreciate any help with this!
If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?
I dont really need it as an alert. It's purpose is not to fire an alert when somebody hasnt acknowledged an alert of a particular severity within a given timeframe, more as a dashboard to display a percentage of those alerts that have been missed.