Splunk Enterprise

Settings for data source to only monitor weekdays


Working a bunch with the Trackme app and it's showing a lot of promise. I finally got the right MLTK and Python applications installed, hopefully that will help some of the issues I'm having.

When I modify a data source, choosing "auto lagging" comes back with unexpected results. In particular, I have a data source that only ingests M-F, between 9am and 5pm. The auto percentile lag of this data source for 7-30 days at 1-3 seconds. How would I go about getting a longer average lag time for this source?

In addition, how can I tell trackme to not show an alert state on the same sourcetype on a monday morning, since it hasn't gotten any events since the friday before? I don't want to set the lag time as too high as that will interfere w/ monitoring during weekdays.

Thanks for your help.

Labels (1)
Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!