How to suppress alerts during holidays

[Ash1]

I have an alert but I want to suppress it during holidays

How can I do that????

[richgalloway]

Splunk doesn't have a built-in feature to do that because Bad Things happen even on holidays.

You can either modify the alert SPL to not trigger on certain days or disable them on those days.  The Holidays app (https://splunkbase.splunk.com/app/4853) may help with that.

[Ash1]

Hi @richgalloway 

Thank you for the inputs

I want to go with the modify my alert query by using look up file 

Like I want to add the holidays dates in the Excel sheet and will upload to splunk

But I am not understanding how to frame a query with that now, below is my query

Index=error-logs  status=401

|Stats count 

Can you please help 

[richgalloway · Accepted solution]

See if this helps.  It assumes the holidays are in a file called 'holidays.csv'.  The lookup contains (at least) two columns called "Begins" and "Ends", which are timestamps in the format mon/day/year hour:min.

index=error-logs status=401 NOT [| inputlookup holidays.csv 
``` Build a search string to exclude dates in the lookup file ```
  | eval search="_time>=" . strptime(Begins,"%m/%d/%Y %H:%M") . " _time<=" . strptime(Ends,"%m/%d/%Y %H:%M") 
  | fields search 
  | format 
``` Remove quotes from the search string ```
  | eval search=replace(search, "\\\"", "")]
| stats count

This tells Splunk to search the error-logs index for events with status 401 and timestamps (_time field) not given in holidays.csv.