How to Black out my splunk alert for particular period ?

[karthi2809]

How to Black out my splunk alert for particular period?

There are two different scenarios
firest alert:

1)16:30 ET Saturday to 00:30 ET Monday on all weekends --->black out time

index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount >5

Second alert:
00:00 to 08:00 ET on weekdays and 20:00 to 08:00 ET on weekends --->black out time

index=Test_PROD source="common" LEGACY_SYSTEM_NAME=Test|rename GUID as CS_GUID| join type=outer CS_GUID [search source="errordetail" NOT [search index=Test_PROD sourcetype="Logging" SEVA+Test OR ACES OR NPI 0x00030001 |rename GUID as CS_GUID | table CS_GUID]] | stats count(eval(TRAN_TYPE="275")) as "T275Count" count(eval(ERROR_CODE="Y42R")) as Y42RCount by LEGACY_SYSTEM_NAME | eval Y42RPerc = Y42RCount*100/T275Count| where Y42RCount >5

[p_gurav]

Hi,

Apparently it's not possible to put all condition in 1 cron schedule, you have to create 4 separate alert with below suggested cron.

1. 16:30 ET Saturday to 00:30 ET Monday on all weekends :

   Cron : */30 * * * 1,2,3,4,5
   : */30 0-16 * * 6

2. 00:00 to 08:00 ET on weekdays and 20:00 to 08:00 ET on weekends
   Cron : */30 9-23 * * 1,2,3,4,5
   : */30 8-19 * * 0,6

[p_gurav]

Foe weekend you want 20:00 to 08:00 ET on weekends this or 16:30 ET Saturday to 00:30 ET Monday on all weekends?

[karthi2809]

Hi p_gurav

mentioned two alert scenarios

[p_gurav]

How frequently this alerts are running? You can do this black out thing with cron schedule, but to help you with that I need alert frequency.

[karthi2809]

every 30 min