I have a problem triggering an alert on a splunk request based on a cron job that runs this way: Search query: index=pdx_pfmseur0_fxs_event sourcetype=st_xfmseur0_fxs_event | eval trackingid=mvindex('DOC.doc_keylist.doc_key.key_val',mvfind('DOC.doc_keylist.doc_key.key_name', "MCH-TrackingID")) | rename gxsevent.gpstatusruletracking.eventtype as events_found | rename file.receiveraddress as receiveraddress | rename file.aprf as AJRF | table trackingid events_found source receiveraddress AJRF | stats values(trackingid) as trackingid, values(events_found) as events_found, values(receiveraddress) as receiveraddress, values(AJRF) as AJRF by source | stats values(events_found) as events_found, values(receiveraddress) as receiveraddress, values(AJRF) as AJRF by trackingid | search AJRF=ORDERS2 OR AJRF=ORDERS1 | stats count as total | appendcols [search index= idx_pk8seur2_logs sourcetype="kube:container:8wj-order-service" processType=avro-order-create JPABS | stats dc(nativeId) as rush ] | appendcols [search index= idx_pk8seur2_logs sourcetype="kube:container:9wj-order-avro-consumer" flowName=9wj-order-avro-consumer customer="AB" (message="HBKK" OR message="MANU") | stats count as hbkk] | eval gap = total-hbkk-rush | table gap, total, rush | eval status=if(gap>0, "OK", "KO") | eval ressource="FME-FME-R:AB" | eval service_offring="FME-FME-R" | eval description="JPEDI - Customer AB has an Order Gap \n \nDetail : JPEDI - Customer AB has an Order Gap is now :" + gap + "\n\n\n\n;support_group=AL-XX-MAI-L2;KB=KB0078557" | table ressource description gap total rush description service_offringe_offring ​ cronjob make on this alerte   I received three alerts containing the same result according to cron job   17H50 18H50 21H50 with same result of gap=9   is there a solution to limit the alert triggering just for once for each time interval from 08:50 => 10:50 from 10:50 a.m. => 3:50 p.m. from 3:50 p.m. to 9:50 p.m. ... View more

index=idx_rdap source="*f5*" "*member*" "RO1B4-0JLSM4000S" "/Common/pool_d2i_*gkrgkl" | rex field=member "\/Common\/(?<server>[^:]*)" | stats latest(status) as Last_status, values(pool), as pool_name, values(_time) as _time by pool, server | stats values(Last_status) as Last_status, values(server) as server by pool | eval severity=case(server="XC001X02" AND server="XC001X03" AND Last_status="down", "1", server="XC001X03" AND Last_status="down", "3", server="XC001X02" AND Last_status="down", "3",true(),"0" ) | table pool, Last_status, severity, server | eval hour_of_the_starttime=strftime(_time, "%H") | eval support_group=if(hour_of_the_starttime>=19 OR hour_of_the_starttime<7,"WW-XX-TFORMEGI-L3", "WW-XX-MSEGI-L2") | eval ressource="GKR-GkL-I:" + pool | eval service_offring="GKR-GkL-I" | eval description="VIP GMS got a service status down \n \nDetail : One or more legs Impacted service on :" + pool + "\n On server(s): " + tostring(server) + " \n\n\n\n; " + support_group + " ;KB=KB00000" | table ressource description pool service_offring severity server support_group ... View more