Splunk Search

search-alert in specified time window

Path Finder

I want to create real time alerts from search which is fired when a condition is met but only between a specific time duration. ex: 9AM to 5PM every weekday exluding weekends. How can I do that?

I found an answer on below link, wondering how can I restric this search to run only during weekdays
http://splunk-base.splunk.com/answers/2219/search-command-for-work-time

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

View solution in original post

Splunk Employee
Splunk Employee

If you want to restrict the schedule of the search to only business days, then use the cron job notation for the search schedule :
example from 9am to 5pm Monday to Friday

 
* 9-17 * * 1-5

see cron notation http://docs.splunk.com/Documentation/Splunk/4.3.3/User/SchedulingSavedSearches#Schedule_the_alert

# Minute Hour Day of Month Month Day of Week Command

# (0-59) (0-23) (1-31) (1-12 or Jan-Dec) (0-6 or Sun-Sat)


If your goal is to search over a specific time range, then you need to use the search time range. and play with the date_* fields in the search conditions

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/SearchTimeModifiers
and http://docs.splunk.com/Documentation/Splunk/4.3.3/User/UseDefaultAndInternalFields

by example to run a search over yesterday, looking only at events between 9am to 5pm :


earliest=-1d@d latest=@d date_hour>9 date_hour<17

View solution in original post