topic Splunk cron expression to accommodate our maintenance window in Alerting

Splunk cron expression to accommodate our maintenance window

namrithadeepak — Thu, 17 Aug 2017 17:55:53 GMT

Hi,

I have to schedule a Splunk alert. I want the alert to be triggered if no of results > 10, except during the maintenance window given below,

Monday to Sunday 4 AM to 6 AM
Sunday morning . 00:00 to 6:AM

What cron expression should I use?

Thanks,
namritha

Re: Splunk cron expression to accommodate our maintenance window

tmarlette — Tue, 29 Sep 2020 15:26:56 GMT

There's no good cron expression for this, as Splunk only allows a single schedule.

the only way I've done safe work times before is using a lookup table, and referencing the date_day / date_hour default fields in it with a | where filter.

Re: Splunk cron expression to accommodate our maintenance window

cpetterborg — Thu, 17 Aug 2017 18:49:16 GMT

You didn't specify the frequency, so I'm going to assume every 5 minutes.

Create two alerts using the same saved search, but you will have to use two different schedules:

*/5 0-3,6-23 * * 1-6
*/5 6-23 * * 0

Re: Splunk cron expression to accommodate our maintenance window

somesoni2 — Thu, 17 Aug 2017 18:49:30 GMT

I believe you'd have option to either create two alerts (same search) with crons handling your maintenance window OR handle the maintenance window in the search itself. For option1 you can use two exact same search (different names of course) with following crons: (assuming you run your alert every 10 mins)

cron 1: */10 6-23 * * * (At every 10th minute past every hour from 6 through 23.)
cron 2: */10 0-3 * * 1-6 (At every 10th minute past every hour from 0 through 3 on every day-of-week from Monday through Saturday.)

We'll need your full alert search with alert conditions to suggest something for option 2.

Re: Splunk cron expression to accommodate our maintenance window

woodcock — Fri, 18 Aug 2017 01:37:30 GMT

You have to use my "short-circuit" or "blackout" approach here, if you really have to keep it as a single search (my answer are the ones that are NOT accepted):
https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-which-it-should-not-generate-alerts.html