I have an alert but I want to suppress it during holidays
How can I do that????
See if this helps. It assumes the holidays are in a file called 'holidays.csv'. The lookup contains (at least) two columns called "Begins" and "Ends", which are timestamps in the format mon/day/year hour:min.
index=error-logs status=401 NOT [| inputlookup holidays.csv
``` Build a search string to exclude dates in the lookup file ```
| eval search="_time>=" . strptime(Begins,"%m/%d/%Y %H:%M") . " _time<=" . strptime(Ends,"%m/%d/%Y %H:%M")
| fields search
| format
``` Remove quotes from the search string ```
| eval search=replace(search, "\\\"", "")]
| stats count
This tells Splunk to search the error-logs index for events with status 401 and timestamps (_time field) not given in holidays.csv.
Splunk doesn't have a built-in feature to do that because Bad Things happen even on holidays.
You can either modify the alert SPL to not trigger on certain days or disable them on those days. The Holidays app (https://splunkbase.splunk.com/app/4853) may help with that.
Thank you for the inputs
I want to go with the modify my alert query by using look up file
Like I want to add the holidays dates in the Excel sheet and will upload to splunk
But I am not understanding how to frame a query with that now, below is my query
Index=error-logs status=401
|Stats count
Can you please help
See if this helps. It assumes the holidays are in a file called 'holidays.csv'. The lookup contains (at least) two columns called "Begins" and "Ends", which are timestamps in the format mon/day/year hour:min.
index=error-logs status=401 NOT [| inputlookup holidays.csv
``` Build a search string to exclude dates in the lookup file ```
| eval search="_time>=" . strptime(Begins,"%m/%d/%Y %H:%M") . " _time<=" . strptime(Ends,"%m/%d/%Y %H:%M")
| fields search
| format
``` Remove quotes from the search string ```
| eval search=replace(search, "\\\"", "")]
| stats count
This tells Splunk to search the error-logs index for events with status 401 and timestamps (_time field) not given in holidays.csv.