[check_alerting_schedule(1)] args = schedule_id definition = `schedule_hours_check($schedule_id$)` \ | `schedule_holiday_check($schedule_id$)` \ | `schedule_maintenance_windows_check($schedule_id$)`\ | eval alerts_active = if((is_business_hours="true" AND is_holiday="false" AND is_maint_win="false"),"true","false") iseval = 0 [schedule_holiday_check(1)] args = schedule_id definition = join \ [| inputlookup schedule_holidays.csv \ | search schedule_id = $schedule_id$ \ | `schedule_local_time($schedule_id$)` \ | eval holiday_start_time = holiday_date." ".start_time \ | eval holiday_end_time = holiday_date." ".end_time \ | convert timeformat="%m/%d/%y %H:%M" mktime(*_time) \ | where current_time > holiday_start_time \ | where current_time < holiday_end_time \ | stats count as holiday_count \ | eval is_holiday = if(holiday_count>0,"true","false")] errormsg = When calling schedule_holiday_check input param schedule_id must be provided iseval = 0 validation = isnotnull($schedule_id$) [schedule_hours_check(1)] args = schedule_id definition = join \ [| inputlookup schedule_hours.csv \ | search schedule_id = $schedule_id$ \ | `schedule_local_time($schedule_id$)` \ | eval day_of_week =strftime(current_time, "%w") \ | where day_of_week = calendar_day_of_week \ | eval current_date =strftime(current_time, "%m/%d/%y") \ | eval hours_startTime = current_date." ".start_time \ | eval hours_endTime = current_date." ".end_time \ | convert timeformat="%m/%d/%y %H:%M" mktime(*Time) \ | where current_time > hours_startTime \ | where current_time < hours_endTime \ | stats count as schedule_hours_count \ | eval is_business_hours = if(schedule_hours_count>0,"true","false")] errormsg = When calling is_holiday input param schedule_id must be provided iseval = 0 validation = isnotnull($schedule_id$) [schedule_local_time(1)] args = schedule_id definition = eval schedule_id = "$schedule_id$"\ | lookup schedules.csv schedule_id \ | eval current_time_local=now() \ | eval schedule_time_formatted =strftime(current_time_local, "%m/%d/%y %H:%M")." ".schedule_timezone \ | eval schedule_time = round(strptime(schedule_time_formatted,"%m/%d/%y %H:%M %Z")) \ | eval offset_hours = round((current_time_local - schedule_time)/3600) \ | eval offset_secs = offset_hours*3600 \ | eval current_time = current_time_local + offset_secs \ | eval current_time_formatted = strftime(current_time, "%m/%d/%y %H:%M") \ | fields - schedule_time, schedule_time_formatted, offset_secs\ \ iseval = 0 [schedule_maintenance_windows_check(1)] args = schedule_id definition = join \ [| inputlookup schedule_maintenance_windows.csv \ | search schedule_id = $schedule_id$ \ | `schedule_local_time($schedule_id$)` \ | convert timeformat="%m/%d/%y %H:%M" mktime(*_time) \ | where current_time > start_time \ | where current_time < end_time \ | stats count as maint_win_count \ | eval is_maint_win = if(maint_win_count>0,"true","false")] errormsg = When calling schedule_holiday_check input param schedule_id must be provided iseval = 0 validation = isnotnull($schedule_id$)