topic Re: Execute an alert based on crontab expression in Alerting

Execute an alert based on crontab expression

zony2021 — Thu, 04 Feb 2021 16:05:47 GMT

Hi all,

i need to execute an alert each 2hours from 8AM to 11PM.

I would like the alert to be scheduled 30mn after.

Ex:8h30 10h30 12h30 14h30 16h30 18h30 20h30 22h30.

Thanks for your help.

PS: i tried 30 8,10,12,14,16,18,20,23 * * * but it does not seem to work well.

Re: Execute an alert based on crontab expression

burwell — Thu, 04 Feb 2021 16:20:58 GMT

Hi. Other than the typo above where you had 23 instead of 22 that cron schedule syntax looks correct.

What is happening exactly for this alert?

You could look in the_internal log for the savedsearch_name= and see if the alert is firing.

Re: Execute an alert based on crontab expression

me74fhfd — Thu, 04 Feb 2021 16:41:52 GMT

Try to shorten crontab like this:
30 8-22/2 * * *

Other than that, make sure you have a privilege to see alert and test alert SPL in search to make sure its retrieving any number of results, since if it is not you wont get alert.

Re: Execute an alert based on crontab expression

zony2021 — Thu, 04 Feb 2021 18:53:33 GMT

Thanks all for your help,

my first input seemed to work also but i did not have certain permissions while creating the alert.

Now it is correct and i got the alert at 12h30 and expecting the next one at 14h30.

Thanks a lot.