Getting Data In

How to hide past events in the FIRST alert with -2h time window

ibob0304
Communicator

My alert runs at 8 AM, 10 AM, 12 PM daily when count < 500 , with a time frame of -2h@h to now.

So, at 8 AM report it shows stats from 6 AM to 8 AM because I gave as -2h@h.
At 10 AM, it shows the records from last 2 hours (8 AM to 10 AM).
At 12 PM, it shows the last -2 hours which is 10 AM to 12 PM.

Now, I want to hide the past 8 AM results in the first 8 AM alert. Like when it trigger at 8 AM first time in a day, it should not show 6 AM records count in it. it should only show 8 AM count.

alt text

Above logic should apply only for the first alert. 10 AM & 12 PM alerts should show all past -2h count like normal.

0 Karma
1 Solution

Sukisen1981
Champion

Hi,

You need to modify the search on which your alert is based.`

your search| eval x=substr(strftime(_time,"%Y-%m-%d %H"),12,2)|eval count=if(x<8,0,count)

Now, all counts less than 8 will return 0 , assuming your alert condition is based on the count value , it will take all values for times below 8 AM as 0 but work for all values greater than equal to 8.
BTW your alert condition in count <500 or count >500?

View solution in original post

Sukisen1981
Champion

Hi,

You need to modify the search on which your alert is based.`

your search| eval x=substr(strftime(_time,"%Y-%m-%d %H"),12,2)|eval count=if(x<8,0,count)

Now, all counts less than 8 will return 0 , assuming your alert condition is based on the count value , it will take all values for times below 8 AM as 0 but work for all values greater than equal to 8.
BTW your alert condition in count <500 or count >500?

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...