<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Cron Expression for scheduled Alert in Security</title>
    <link>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575367#M15714</link>
    <description>&lt;P&gt;You can't write some of them as a single cron schedule.&lt;/P&gt;&lt;P&gt;For example - if your frequency is "every 15 minutes", you can't run it from something :00 till something else :59. Your latest occurrence would be :45, not :59.&lt;/P&gt;&lt;P&gt;Amd, since you can only specify how each datetime part changes on it's own, you can't do "every 15 minutes from something :00 up to and including something else :00". If you specify both ranges/generators or whatever you call them for hours and for minutes they will both get expanded separately.&lt;/P&gt;&lt;P&gt;So&lt;/P&gt;&lt;PRE&gt;*/15 7-9&lt;/PRE&gt;&lt;P&gt;(To only focus on minutes and hours, forget the other parts of cron spec)&lt;/P&gt;&lt;P&gt;will generate times from 7:00 up to 9:45. There is no way to include just 10:00 without 10:15, 10:30 and 10:45.&lt;/P&gt;&lt;P&gt;You'd neeed a separate schedule just for 10:00.&lt;/P&gt;</description>
    <pubDate>Thu, 18 Nov 2021 05:21:32 GMT</pubDate>
    <dc:creator>PickleRick</dc:creator>
    <dc:date>2021-11-18T05:21:32Z</dc:date>
    <item>
      <title>Cron Expression for scheduled Alert</title>
      <link>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575364#M15713</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Please help me to build cron expression. thanks in advance&lt;/SPAN&gt;&lt;/P&gt;&lt;TABLE width="533"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="533"&gt;Alert runs Every 15min from 8am to 18pm, Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 4am to 18pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 8am to 18pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 9am to 17pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 8am to 18:45pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 23:01 pm to 18:59pm Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 12am to 12:59am and 6am to 6:59am Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 8am to 8:59am and 13pm to 13:59pm Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 10am to 6:59am Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 7am to 23:59pm Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert runs Every 15min from 8am to 10:59am Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Thu, 18 Nov 2021 04:02:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575364#M15713</guid>
      <dc:creator>jackin</dc:creator>
      <dc:date>2021-11-18T04:02:34Z</dc:date>
    </item>
    <item>
      <title>Re: Cron Expression for scheduled Alert</title>
      <link>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575367#M15714</link>
      <description>&lt;P&gt;You can't write some of them as a single cron schedule.&lt;/P&gt;&lt;P&gt;For example - if your frequency is "every 15 minutes", you can't run it from something :00 till something else :59. Your latest occurrence would be :45, not :59.&lt;/P&gt;&lt;P&gt;Amd, since you can only specify how each datetime part changes on it's own, you can't do "every 15 minutes from something :00 up to and including something else :00". If you specify both ranges/generators or whatever you call them for hours and for minutes they will both get expanded separately.&lt;/P&gt;&lt;P&gt;So&lt;/P&gt;&lt;PRE&gt;*/15 7-9&lt;/PRE&gt;&lt;P&gt;(To only focus on minutes and hours, forget the other parts of cron spec)&lt;/P&gt;&lt;P&gt;will generate times from 7:00 up to 9:45. There is no way to include just 10:00 without 10:15, 10:30 and 10:45.&lt;/P&gt;&lt;P&gt;You'd neeed a separate schedule just for 10:00.&lt;/P&gt;</description>
      <pubDate>Thu, 18 Nov 2021 05:21:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575367#M15714</guid>
      <dc:creator>PickleRick</dc:creator>
      <dc:date>2021-11-18T05:21:32Z</dc:date>
    </item>
    <item>
      <title>Re: Cron Expression for scheduled Alert</title>
      <link>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575371#M15715</link>
      <description>&lt;P&gt;Thankq&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884"&gt;@PickleRick&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Can you help in below updated sheet&lt;/P&gt;&lt;TABLE width="348"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="348"&gt;Alert Every 15min from 8am to 18pm Everyday&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 4am to 18pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 8am to 18pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 9am to 17pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 8am to 18:45pm weekdays only&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 23:00 pm to 19pm&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 12am to 1am&amp;nbsp;&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 6am to 7am&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 8am to 9am&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 13pm to 2pm&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 10am to 7am&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 7am to 12am&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD&gt;Alert Every 15min from 8am to 11am&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Thu, 18 Nov 2021 05:46:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575371#M15715</guid>
      <dc:creator>jackin</dc:creator>
      <dc:date>2021-11-18T05:46:24Z</dc:date>
    </item>
  </channel>
</rss>

