topic Re: Multiple Cron Schedules In One Saved Search in Alerting

Multiple Cron Schedules In One Saved Search

itsomana — Thu, 22 Mar 2012 15:01:06 GMT

Is it possible to have more than one cron schedule in a saved search. I have a save search that starts Monday to Saturday at 7:26am and stops at 18:30 Monday, Thursday and Saturday, however on Friday it stops at 17:30.

Re: Multiple Cron Schedules In One Saved Search

gkanapathy — Thu, 22 Mar 2012 17:46:47 GMT

No. You would have to create multiple saved searches, and configure them the same other than the schedule. They would have to have different names, and could not be used to populate a dashboard, but I assume you're using this to send out an alert, or run a job.

Re: Multiple Cron Schedules In One Saved Search

woodcock — Thu, 24 Mar 2016 22:49:06 GMT

Check out my answer in the following link (it is NOT the accepted one) for a way to do this in a single search with a single cron, provided your crons share the same periodicity (timespan between runs):

https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html

Re: Multiple Cron Schedules In One Saved Search

shawngarrettsgp — Fri, 25 Mar 2016 12:45:19 GMT

I downvoted this post because there is a more elegant answer to do this in one alert still, rather than creating 3 separate alerts.

Re: Multiple Cron Schedules In One Saved Search

woodcock — Tue, 29 Mar 2016 08:11:07 GMT

You should be able to accept this as the correct answer now.