Splunk Search

Time based Monitoring

jerinvarghese
Path Finder

Hi Team,

I am having few devices located across the globe and want to monitor only during their Business hour timings only.

 

index=opennms
| fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S")
| table DEVICE,ALERT,SITECODE,COUNTRY,REGION,TIME_ZONE

 

 

Output :

DEVICEALERTSITECODECOUNTRYREGIONTIME_ZONE
FRNDGDEVICE DOWNNDGFranceEurope+01:00
FRNDGINTERFACE DOWNNDGFranceEurope+01:00
SGACBBGP DOWNACBSingaporeAsia Pacific+08:00
NGERHINTERFACE UTILIZATIONERHNigeriaMiddle East / Africa+01:00
USBMTISIS FLAPBMTUnited StatesNorth America-06:00
USBTNBGP DOWNBTNUnited StatesNorth America-06:00
SGSNGINTERFACE DOWNSNGSingaporeAsia Pacific+08:00
USEMCDEVICE DOWNEMCUnited StatesNorth America-06:00
CAKRLINTERFACE DOWNKRLCanadaNorth America-07:00
FRFOSBGP DOWNFOSFranceEurope+01:00

 

only during the 9AM to 5PM  of that business hour of that country Splunk should search for alerts or generate alerts and rest all time it should disable the alerting, is that possible.

Labels (7)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!