Splunk Search

Splunk alert to be triggered based on time of the day

anweshar
New Member

My search condition is checking for results less than 10 every 45 minutes. The problem is we don't have that much traffic in the night to make it up to 10 searches. Is there an option to alert based on time of the day, for example trigger an alert if the number of searches is less than 10 between 09:00 to 18:00 and in the off hours trigger an alert if the number of searches is less than 3.

I can write a separate splunk alert to cover off hours but wanted to check if there is an option to do this in the one alert.

0 Karma

adonio
Ultra Champion

you can write an eval statement for example and alert on its results, example:
... your search ... | eval bus_hours = if(date_hour>=9 AND date_hour<=18,"yes","no") ...
| eval alert = if(your_count < 10 AND bus_hours = "yes","alert","not_alert) ...

and now count the new alert field or configure your alert however you want

hope it helps

0 Karma

jkat54
SplunkTrust
SplunkTrust

I've been told not to use date_wday with stats due to some typical fringe cases where it's inaccurate. It's a calculated field after all.

It would be better (again I'm told by the smarter folks) to eval the hour like this:

| eval hour=strftime(_time,"%H")

Then use the conditional logic on it.

0 Karma

woodcock
Esteemed Legend

The date_* fields can be used IF they are there (there are not in every sourcetype/event); just be aware that they are interpreted to be in the timezome of the local event, not normalized to GMT/Zulu.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...