topic Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS in Alerting

Splunk CRON Implementation incorrect in SEARCH-ALERTS

SplunkShawnCt — Mon, 16 Mar 2015 16:49:09 GMT

Searches, reports, and alerts allows me to enter a CRON schedule with Dual ranges. For instance in the hour field if I do not want to run at 3:00 AM I can use this schedule to run every 15 minutes.

*/15 0-2,4-23 * * *

This is allowed under standard CRON. If instead of editing the CRON schedule in Searches, reports, and alerts I instead try to edit it the REPORTS or ALERTS section of the Splunk App I get an Invalid CRON error. I would attach a picture but it says I need more points.

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

ppablo — Mon, 16 Mar 2015 17:02:08 GMT

Hi @SplunkShawnCt

Would you be able to provide a link to the image hosted on another site? A lot of other users do that instead of uploading it directly on here. Also, are you referring to the Search and Reporting App when you say "Splunk App"?

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

SplunkShawnCt — Mon, 16 Mar 2015 20:17:02 GMT

See attached

http://i.imgur.com/c7JQKkn.png

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

SplunkShawnCt — Mon, 16 Mar 2015 20:33:12 GMT

Under Settings if you go to Knowledge -> Searches, reports, and alerts

And select a search there you can enter a CRON schedule that contains two ranges. If you go to the Search App and Click Alerts or Reports and try to edit a CRON Schedule there you will get the error I am talking about. Under dashboards in the search app you can again schedule things on a CRON schedule and have double ranges is valid.

By double ranges I mean two ranges seperated by a comma, (Like in the above picture for the hour field)

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

somesoni2 — Mon, 16 Mar 2015 20:53:33 GMT

What version of Splunk you're using? Tested the same on 6.2.1 and your cron worked fine "*/15 0-2,4-23 * * *"

From Settings->Searches, reports and alerts
Go to App -> Searches Navigation Menu-> Edit ->Schedule
Go to App -> Alerts Navigation Menu -> Edit ->Schedule

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

SplunkShawnCt — Tue, 24 Mar 2015 14:56:37 GMT

Version 6.1.2

Editing the Schedule from Settings -> Searches, reports and alerts works fine for me.

The problem only occurs in the Search & Reporting app when using either the Alerts or Reports tab.

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

frobinson_splun — Tue, 28 Apr 2015 23:57:54 GMT

Hi @SplunkShawnCt,
I am a tech writer here at Splunk and I've been troubleshooting what sounds like a similar issue with a different app. I'll check with our engineering team to see if it's related.

The other post I've been working on is:
http://answers.splunk.com/answers/120603/cron-expression-in-splunk.html

I'll report back with any info I find.
Thanks,
frobinson

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

frobinson_splun — Wed, 29 Apr 2015 17:17:50 GMT

Hi @SplunkShawnCt,
I've reported this issue as a bug and asked our search and reporting UI folks to investigate. It seems there is a validation issue in the UI, according to one of our cron expression engineers. Thanks for bringing it to our attention! I'll report back with any other updates.
best,
frobinson

Re: Splunk CRON Implementation incorrect in SEARCH-ALERTS

frobinson_splun — Wed, 29 Apr 2015 18:37:11 GMT

I've asked our engineering team and it is a known bug with 6.1.2. It has been fixed as of 6.1.3. @SplunkShawnCt, if you can upgrade to 6.1.3 or beyond you should be good to go. Let me know if you have further questions on this issue.

Thanks!
frobinson