topic Re: Splunk alert are not triggering specific days in Alerting

Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 06:11:45 GMT

A alert is configured to schedulre cron trigger with expression 0 11 * * 1,4.

But its triggering on non specific days, like on Tuesday and Wednseday?

What could be the problem here? i checked using crontab.guru, its showing correct validation.

Thanks In Advance.

Re: Splunk alert are not triggering specific days

gcusello — Thu, 17 Jul 2025 06:18:52 GMT

Hi @krishna4murali ,

which are the days when the alert must be executed?

as you can read at https://it.wikipedia.org/wiki/Crontab, using the cron expression 0 11 * * 1,4 you execute it on Sunday and Wednseday.

Then, check the execution days of your alert, anyway, on Tuesday it shouldn't be executed.

Ciao.

Giuseppe

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 06:24:47 GMT

0 11 * * 1,4 means it should be executed on Monday and Thursdays only accoridng to crontab.guru.

Re: Splunk alert are not triggering specific days

livehybrid — Thu, 17 Jul 2025 06:30:55 GMT

Hi @krishna4murali

Does it run at the expected time of 11:00?

Im wondering if there is an invalid character in the 1,4 part somewhere thats causing it to run everyday.

Just to clarify, theres no space between the comma and the next digit? No characters after the 4?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 06:36:11 GMT

Thanks for reply @livehybrid ,

There are no invalid characters on cron and there is no space between the comma and after last digit.

Re: Splunk alert are not triggering specific days

PrewinThomas — Thu, 17 Jul 2025 06:40:30 GMT

@krishna4murali

That behavior isn't expected—using 0 11 * * 1,4 in your cron schedule should result in the job triggering only at 11:00 AM on Mondays and Thursdays.

Could you confirm: Is the job actually running at 11:00 AM on Tuesdays and Wednesdays, or at any other unexpected times?

Please check: Review the time zone setting on the system host where this cron is configured.

Also for testing try to configure with below just to make sure it's executing as expected or not.

0 12 * * *

Ideally should execute At 12 PM every day, on the hour

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Splunk alert are not triggering specific days

livehybrid — Thu, 17 Jul 2025 06:48:41 GMT

How very strange!

This might sound funny question - but the alert you are seeing being triggered is definitely the alert you're looking at and that its not a clone of or similar alert?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 07:36:25 GMT

Nope, its not a clone.

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 07:37:28 GMT

It's running at unexpected days in the same time

Re: Splunk alert are not triggering specific days

gcusello — Thu, 17 Jul 2025 08:10:27 GMT

Hi @krishna4murali ,

yes, sorry, I was wrong: Sunday and Thursday!

anyway, in the triggered alerts dashboard, you can see if the wrong days executions are related to your alert or to another one.

Ciao.

Giuseppe

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 08:49:24 GMT

Is there any possibility that with orphaned alerts or kind of? without index in search params?

Re: Splunk alert are not triggering specific days

gcusello — Thu, 17 Jul 2025 08:53:03 GMT

Hi @krishna4murali ,

check in the triggered alerts dashboard and/or in the alerts dashboards if the wrong date alerts are from that alerts or from another.

Ciao.

Giuseppe

Re: Splunk alert are not triggering specific days

krishna4murali — Thu, 17 Jul 2025 13:05:07 GMT

We have changed in the desired alert to see if another private clone triggerign the message, but wont know untill Tuesday.. let's wait.