Splunk IT Service Intelligence

Is it possible for Alerts blackout functionality in Splunk/ITSI?


hi Team,

During any maintenance releases of WebSite , is it possible to have monitoring alerts blackout functionality in splunk so we don't receive any notable events/alerts in ITSI or Splunk.

Or is it possible to enable the blackout of a specific services in ITSI for not generating notable events.


0 Karma


In Splunk ITSI you have something like "Maintenance Schedule" where you set a timeperiod which will "blackout" specific entities or services. Check out this link for more information: https://docs.splunk.com/Documentation/ITSI/4.0.3/Configure/MaintenanceWindows

In Splunk itself you could create a macro or lookup functionality which checks if a maintenance release is active. Then the alert must be configured to check this result. Though it would be more work to set up at first, but when you release often it is quicker.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...