Splunk Search

Can I set timerange in alerts with custom time?

mahesh27
Communicator

I am creating an alert where the time range should be from 7 to 18 and corn schedule is for 5 mins

So in my alert if i give earliest=@d+7h and latest =@d+18h will this works??
And i dont want to receive alert after this time range.

how i can do this??

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To do that, use earliest=-13h latest=-1h

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Using earliest=@d+7h latest =@d+18h restricts the search to events that happened during work hours.  The alert still runs 24 hours a day so, depending on what triggers the alert, you may still receive an alert after hours.

To prevent an after-hours alert, change the cron schedule to run the alert only from 700-1800.

1-59/5 7-17 * * *

Notice how the last hour is 17 so the last alert runs at 17:56 rather than 18:56.

---
If this reply helps you, Karma would be appreciated.

mahesh27
Communicator

thankyou @richgalloway , it worked.
i have one more question.

if i want to run my alert for last 12 hours, like it should run at 6am  and 6pm , and for 6am run it should collect data from 5pm to 5am(12h) and for 6pm run it should take data from 5am to 5pm 

this can be done???

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To do that, use earliest=-13h latest=-1h

---
If this reply helps you, Karma would be appreciated.

mahesh27
Communicator

Thankyou @richgalloway  if worked

 

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...