topic Re: Cron expression for splunk alert in Alerting

Cron expression for splunk alert

shashi584 — Mon, 24 Jan 2022 15:57:23 GMT

I Want to create one splunk alert where it runs on all weekdays and Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST"

Can you help me with a Cron expression that satisfies the above requirement?

I need the alert to be set up in CST time zone only

Re: Cron expression for splunk alert

gcusello — Mon, 24 Jan 2022 16:02:36 GMT

Hi @shashi584,

did you tried with

* * * * 1-5

you have to define the condition for the fifth parameter (1-5) then you can define the dayly frequency, e.g. every hour it could be:

0 * * * 1-5

Ciao.

Giuseppe

Re: Cron expression for splunk alert

shashi584 — Mon, 24 Jan 2022 16:06:22 GMT

Hi @gcusello

Thanks for the reply, Yes i tried the below Expression which runs every hour past 30 minutes from Mon-Fri

30 * * * 1-5

However, my requirement is to Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST" which is tricky part and not sure how to set up in CST time zone.

In My preference, if i set up in CST time zone , will that work ?

Re: Cron expression for splunk alert

gcusello — Mon, 24 Jan 2022 16:11:34 GMT

Hi @shashi584,

the it isn't possible to setup the timezone in the cron expression, it define the hours of execution, if you have a time in CST or a different timezone it a definition of your system, not of cron.

Ciao.

Giuseppe