Splunk Search

search-alert in specified time window

parth_jec
Path Finder

I want to create real time alerts from search which is fired when a condition is met but only between a specific time duration. ex: 9AM to 5PM every weekday exluding weekends. How can I do that?

I found an answer on below link, wondering how can I restric this search to run only during weekdays
http://splunk-base.splunk.com/answers/2219/search-command-for-work-time

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

View solution in original post

yannK
Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...