topic Can I achieve a CRON schedule that skips a 15 minute interval? in Alerting

Can I achieve a CRON schedule that skips a 15 minute interval?

darbritto — Thu, 30 Mar 2023 07:43:42 GMT

Hello Everyone,

I have an alert that runs every 15 minutes and checks logs for last 15 minute time span. I want the alert to not run for 1:30 am cycle.

Currently I am using the cron expression */15 0-1,2-23 * * *

But this will skip all schedules between 1 -2 am [1:00, 1:15, 1:30, 1:45]

Is there anyway I can only skip the alert scheduled at 1:30 am (searches time range 1:15:00 to 1:30:00 ) within one cron schedule.

I know it can be done easily with 2 schedules but was wondering if this can be achieved within one CRON expression.

Thanks.

Re: CRON schedule skip a 15 minute interval

ITWhisperer — Wed, 29 Mar 2023 20:52:43 GMT

It isn't possible by a single cron schedule - you could modify your report so that it checks the current time and returns no results if it is 01:30

Re: CRON schedule skip a 15 minute interval

darbritto — Wed, 29 Mar 2023 21:27:13 GMT

thanks I was able to use a logical variable to set / unset it based on time as a workaround.

eval alertFlag=if( strftime(info_max_time, "%H:%M")!="01:30",1,0)

Re: CRON schedule skip a 15 minute interval

yeahnah — Wed, 29 Mar 2023 21:39:38 GMT

Hi @darbritto

@ITWhisperer is correct, either use two cron schedules, or modify your SPL query to not produce results when run at a certain time or time range. Here's an example I've used in the past

| makeresults
| eval now_hour=ltrim(strftime(now(), "%H"), "0"), now_min=ltrim(strftime(now(), "%M"), "0")
| where now_hour!=1 OR (now_hour=1 AND (now_min >= 30 OR now_min <= 35)) ``` only produce results if the time range is outside of 01:30-01:35 ```

Hope this helps

Re: CRON schedule skip a 15 minute interval

darbritto — Wed, 29 Mar 2023 21:33:37 GMT

Thanks!

Since its only one time window I am trying to skip tweaking my search query was much easier. I was able not produce results for that one window with logic something similar to what you had suggested.