topic Re: Splunk Cron expressions not to trigger alert in Alerting

Splunk Cron expressions not to trigger alert

sureshkumaar — Thu, 09 Jul 2020 13:38:22 GMT

Hi All,

I am looking for a cron expression NOT to trigger alert for a particular period of time on daily basis. Alert is scheduled to run for every 10 minutes.

1:00 AM to 1:15 AM

2:00 AM to 2:15 AM

Kindly help me.

Re: Splunk Cron expressions not to trigger alert

richgalloway — Thu, 09 Jul 2020 13:55:10 GMT

cron does not have a concept of "not". It only specifies run times, not don't-run times. If you can't craft a cron expression that excludes undesired times, then consider multiple searches with cron schedules that combine to cover the desired times. For example:

0/10 0 * * * # Every 10 minutes during hour 0 15-59/10 1,2 * * * # Every 10 minutes starting at x:15 during hours 1 and 2 0/10 3-23 * * * # Every 10 minutes for the remainder of the day

I use https://crontab.guru/ to test my cron strings.

Re: Splunk Cron expressions not to trigger alert

sureshkumaar — Thu, 09 Jul 2020 14:30:37 GMT

Thank you very much @richgalloway i will check this in testing alert and let you know the updates

Re: Splunk Cron expressions not to trigger alert

sureshkumaar — Sat, 18 Jul 2020 13:44:46 GMT

@richgalloway Thanks for the quick solution it worked good

Re: Splunk Cron expressions not to trigger alert

sureshkumaar — Thu, 23 Jul 2020 12:40:33 GMT

@richgalloway - Can i get cron expression for the alerts not to trigger on sunday from 12 AM - 8 AM alone?

i tried below but the alerts for remaining days it's not getting triggered as the cron expression is specifically for Sunday alone to not trigger from 12 AM - 8 AM.

10-59/10 08 * * 7

Re: Splunk Cron expressions not to trigger alert

richgalloway — Thu, 23 Jul 2020 13:52:27 GMT

As I said in my original reply, cron does not have a concept of "not". It only specifies run times, not don't-run times. If you can't describe the schedule in a single cron then you may need multiple instances of the alert with different cron expressions.

10-59/10 8-23 * * 7 10-59/10 * * * 1-6