Hi @gcusello - Still not working and results are getting displayed ... View more

Hi @gcusello - i cannot share the actual/complete search but something with Splunk fields i can share   source=*cpu* cpu_load_percent>75 NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7)) | stats latest(cpu_load_percent) as cpu_max_usage by _time, host | table _time host cpu_max_usage ... View more

Hi @gcusello  - I tried now but still results are getting shows in the events view NOT (date_wday=monday AND date_hour>=0 AND (date_hour<7)) What I could observe here is when the stats command in place _time field isn't working in Splunk so the condition we use here looks for the query where _time filed is effectively used. Kindly let me know your thoughts/observations on this ... View more

Hi @gcusello - Looks like this condition isn't working in the query where we use "stats" part of query for CPU, Memory, Disk space alerts. Kindly suggest   NOT (date_wday=monday AND date_hour>=00 AND (date_hour<07)) ... View more

Hi @to4kawa - Can you update is there any way to have a cron expression for this requirement ... View more

Hi @to4kawa  I am using search at 20 minute interval ... View more

Actually i am not confused, the requirement is not to trigger alerts with events showing time between 1:30 AM - 2:00 AM on daily basis. Based upon this requirement i was looking for a cron expression ... View more

  @richgalloway   - It's my BAD, in the lookup table "Destination filename" i updated without file extension ".csv" after typing file name with it's extension. It worked now successfully Kindly let me know for below clarifications i needed and i can try testing as well 1. Do i need to update this search in the queries for all the alerts where the hosts is in usage? NOT [ | inputlookup DecomMaint.csv | fields host | format ] OR 2. is there any way saving this maintenance search as an informational alert and look for all the alerts available in that Splunk and have this maintenance search query effectively run using cron expression setting for a period to not to show the hosts only during that time? For Ex:- */10 0-1 * * * - setting this will make sure the maintenance query working only during 12 AM - 1 AM EST and results not returning the hosts which i mention in the Lookup file for that time 12 AM - 1 AM. ... View more

  @richgalloway i tried the query "| inputlookup DecomMaint.csv | fields host | format" ... View more

@richgalloway My CSV file has only one host with field called "host", i tried with this query also but returned the events for the host from the csv file also. Kindly suggest ... View more

@richgalloway - Apologize for the delay , i tried with 3 hosts in the query and added only one host in the CSV file but still it's returning for that host as well. Kindly help  ... View more

Hi @richgalloway  Thanks for your reply I tried something below and mentioned only one hosts in the csv file but still i found the events for that host as well. Kindly let me know is there anything i need to modify/update in this query. host=host1* OR host=host2* OR host=host3* NOT [ | inputlookup DecomMaint.csv | format ] ... View more

@richgalloway  - Can i get cron expression for the alerts not to trigger on sunday from 12 AM - 8 AM alone? i tried below but the alerts for remaining days it's not getting triggered as the cron expression is specifically for Sunday alone to not trigger from 12 AM - 8 AM. 10-59/10 08 * * 7 ... View more

@richgalloway Thanks for the quick solution it worked good ... View more

Thank you very much @richgalloway i will check this in testing alert and let you know the updates ... View more

Hi @gcusello - Is there any option than doing it manually??? ... View more

@gcusello If i have more values to check, you provided the below line for the query. | append [ | inputlookup my_lookup.csv | eval count=0 | fields check_source count ] In the CSV file i have to provide only the source or the whole line naming the column name as check_source like below with column header named as "check_source" | append [ | makeresults | eval check_source="abcedef", count=0 | fields check_source count ] | append [ | makeresults | eval check_source="ghijkl", count=0 | fields check_source count ] | append [ | makeresults | eval check_source="mnopqr", count=0 | fields check_source count ] Kindly suggest ... View more