topic Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered in Alerting

How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

wanda619 — Wed, 02 Nov 2022 02:39:08 GMT

right now i have a cron expression like this - 0 * * * *

so the report is sent out every hour. How can i generate the report only once when the condition is triggered.

Thanks!

Re: how can i schedule a cron job only once? for example the alert should stop once a condition is triggered

johnhuang — Wed, 02 Nov 2022 02:30:00 GMT

Not sure if you want one time use alert or one alert per run. For the latter: configure the Trigger to "Once" which will limit the alert to one per run.

Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

gcusello — Wed, 02 Nov 2022 07:44:58 GMT

Hi @wanda619,

as @johnhuang said, you can set your alert to send only one message when the alert fires and not one for each result you have in your alert.

If you don't want to receive messages for a predefined time period after a firing, you can set the throttle.

Ciao.

Giuseppe

Re: how can i schedule a cron job only once? for example the alert should stop once a condition is triggered

wanda619 — Wed, 02 Nov 2022 12:05:54 GMT

@johnhuang yes specifically looking for one time use alert,, since now it i giving alert every hour. I am looking to set alert once at the beginning

Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

wanda619 — Wed, 02 Nov 2022 13:08:40 GMT

@gcusello right now the alert is set in such way that report is being sent every hour, i am trying to find a way ,so that it sends one report per day. cron expression i am using is 0 * * * *

Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

richgalloway — Wed, 02 Nov 2022 13:22:12 GMT

To limit the number of alerts to one per day, use the Throttle feature. Edit the alert, check the "Throttle" box, then set the "Suppress triggering for" settings as shown. Then click Save.

BTW, try to avoid scheduling alerts at minute 0. This tends to be the most popular time for running searches so you risk searches being skipped if there aren't enough resources available.

Re: How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

gcusello — Wed, 02 Nov 2022 13:24:58 GMT

Hi @wanda619,

if you see in the panel where you set the cron schedule, there's an option to throttle events (it's a check flag).

Flagging it you can say to Splunk that if an alert is fired, the alert must be runned again after 24 hours.

Ciao.

Giuseppe