topic Splunk cron question in Splunk Dev

Splunk cron question

msehic — Tue, 13 Mar 2018 20:28:46 GMT

What would be the best way to schedule Alert Cron Expression running every 5 min from Sunday 10 AM until Friday 5 PM?

Re: Splunk cron question

p_gurav — Wed, 14 Mar 2018 04:55:53 GMT

Try something like:

*/5 10-17 * * 0-5

Re: Splunk cron question

msehic — Wed, 14 Mar 2018 19:06:10 GMT

thank you for responding.
I think this would make sense only if you run every day from 10-17 Sun to Fri.
It would not cover for example 17:00 Mon until 10:00 Tuesday.

Only option I see is with 3 cloned alerts running separated times:

*/5 * * * 1-4 -> Monday - Thursday
*/5 0-17 * * 5 -> Friday.
and something on Sunday.

wondering if anyone came up with better idea.