Welcome to Splunk Answers, I guess? Because you forget to tell us what it entails to be a planned downtime. Do you mean to shut down your Splunk instance for some time during a day? Do you mean to not ingest data for some time during a day? Do you mean not to display data in search/dashboard for some time during a day? Do you mean to run scheduled search for some time during a day? Do you mean not to send alerts for some time during a day?
What is the input to determine what time is downtime? Is it hard coded? Is it periodic? Is it from some external data source? Is it based on user selection?
Again, welcome to Splunk Answers. But before you get answers, you must first volunteer answers to some basic questions a barber on the other side of the telephone line (otherwise known as volunteers) may need in order to give you a remote haircut.
