Splunk Search

Table ES Suppressions including start time and end time

jacqu3sy
Path Finder

I'm looking to create a dashboard of existing suppression's, and those that have recently expired or will expire in the near future.

But I'm struggling to find where I can extract the relevant >=time and <=time used within the suppression.

notable includes the suppression name, but not when it expires. Cant seem to find where this is stored. Any ideas?

0 Karma
1 Solution

grsmith
Engager

I had this question as well, because I wanted to set up alerts around soon to expire suppressions. I found an out-of-box macro that gathers the relevant info using the "rest" search command.

| suppression_eventtypes

View solution in original post

0 Karma

grsmith
Engager

I had this question as well, because I wanted to set up alerts around soon to expire suppressions. I found an out-of-box macro that gathers the relevant info using the "rest" search command.

| suppression_eventtypes

0 Karma

jacqu3sy
Path Finder

Thats exactly what I was after. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...