Dashboards & Visualizations
Highlighted

Dashboard for a 1 week search only between core working hours

Path Finder

Hi,

Is there a way of returning alerts from a search query but only for between core working hours over a period of 7 days?

Essentially, I need a dashboard to return results for when Critical severity alerts have not been closed within 2 hours, but only for between the hours of 08:00 - 17:00. So basicly just a gauge to show a percentage of those alerts which missed the KPI.

Currently I have the following which appears to work, but I'm not sure how to only make it applicable for between 8 - 5.

| incident_review | where like(statuslabel,"Assigned-%") OR like(statuslabel,"Closed-%") | transaction ruleid | where eventcount>1 | fields _time, duration, eventcount, owner, reviewer, ruleid, status, urgency | join ruleid [ search notable | rex field=eventtype "(?P\w+\\w+)-" | search NOT SpStatus="notablesuppression" | rename urgency as NTurgency | fields ruleid, status, statuslabel, NTurgency] | eval FinalUrgency=if(isnull(urgency),NTurgency,urgency) | eval RTimeTaken=duration/60 | where status="2" AND (status="3" OR status="4" OR status="5") | eval TimeTaken=duration | search FinalUrgency=critical | eval QueueStatus=if(RTimeTaken<120,"Yes", "No") | stats count by QueueStatus | eventstats sum(count) as total | eval percent= round ( count*100/total,1) |where match(QueueStatus,"Yes") | gauge percent 0 80 90 100

I'd really appreciate any help with this!

Thanks.

0 Karma
Highlighted

Re: Dashboard for a 1 week search only between core working hours

Communicator

If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?

View solution in original post

0 Karma
Highlighted

Re: Dashboard for a 1 week search only between core working hours

Path Finder

I dont really need it as an alert. It's purpose is not to fire an alert when somebody hasnt acknowledged an alert of a particular severity within a given timeframe, more as a dashboard to display a percentage of those alerts that have been missed.

0 Karma
Highlighted

Re: Dashboard for a 1 week search only between core working hours

Communicator

Got you, check out this. Seems like they had a similar problem as you have right now:

https://answers.splunk.com/answers/69820/search-to-only-include-business-hours-and-exclude-weekends....

0 Karma
Highlighted

Re: Dashboard for a 1 week search only between core working hours

Path Finder

Perfect, just what I was looking for. Many thanks.

0 Karma