Hi @Cheng2Ready To implement the desired behavior for muting alerts following holidays based on your holiday dates, you can modify your Splunk query to handle the special case where the holiday fal...
See more...
Hi @Cheng2Ready To implement the desired behavior for muting alerts following holidays based on your holiday dates, you can modify your Splunk query to handle the special case where the holiday falls on a Friday. Here's a revised version of your query that checks for Friday holidays and adjusts the day to mute alerts: index=<search>
| eval Date=strftime(_time, "%Y-%m-%d")
| lookup holidays.csv HolidayDate as Date output Holiday
| eval should_alert = if(isnull(Holiday), "Yes", "No")
| eval day_of_week = strftime(_time, "%A") // Get the day of the week
| eval mute_date = if(day_of_week == "Friday", Date + 3*86400, Date + 86400)
// Mute for Friday holidays
| eval mute_alert = if(mute_date == Date, "No", should_alert) // Adjust mute
based on the calculated mute date
| table Date mute_alert
| where mute_alert = "Yes" Explanation: Day of the Week Calculation: `strftime(_time, "%A")` retrieves the day of the week for the given date. Mute Date Calculation: The line: `eval mute_date = if(day_of_week == "Friday", Date + 3*86400, Date + 86400)` determines the mute date based on whether the holiday is on a Friday or another day. If it's Friday, it adds 3 days (including the weekend) to the mute date; otherwise, it adds only 1 day. Mute Alerts Logic: We then check if the current date matches the `mute_date`, setting `mute_alert` accordingly. Final Filtering: The `where` clause filters results to only keep entries where alerts should still fire, aligning with your requirements. This should successfully mute alerts on the day following any holiday based on the criteria you've established. Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will