https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358521#M105986 <P>@cusello Oh ! i wish splunk provides us a possibility to write them in one alert ..anyways thank you for letting me know..</P> Fri, 17 Mar 2017 19:40:15 GMT srisplunk12 2017-03-17T19:40:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358515#M105980 <P>How to write a crontab from Monday 6 AM through Saturday 2 AM to run once in a hour.</P> Thu, 16 Mar 2017 15:29:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358515#M105980 srisplunk12 2017-03-16T15:29:13Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358516#M105981 <P>Hi srisplunk12,<BR /> it's not possible to write only one crontab for your need.<BR /> The close solution could be to create three alerts with three complementary crontabs:</P> <PRE><CODE>- 0 * * * 2-5 - 0 6-23 * * 1 - 0 0-1 * * 6 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 16 Mar 2017 15:48:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358516#M105981 gcusello 2017-03-16T15:48:46Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358517#M105982 <P>thank you @Giuseppe ..but can you please advice as to how do i put all four expressions in a single Splunk alert ?</P> Thu, 16 Mar 2017 17:47:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358517#M105982 srisplunk12 2017-03-16T17:47:53Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358518#M105983 <P>Check out my (sadly unaccpted) answer here for how to do it:</P> <P><A href="https://answers.splunk.com/answers/172541/is-it-possible-to-purposely-cause-a-scheduled-sear.html">https://answers.splunk.com/answers/172541/is-it-possible-to-purposely-cause-a-scheduled-sear.html</A></P> Thu, 16 Mar 2017 19:44:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358518#M105983 woodcock 2017-03-16T19:44:14Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358519#M105984 <P>If the schedule you described is a mandatory rule, the only way is to create three equal alerts with the same search but a different schedule.<BR /> Bye.<BR /> Giuseppe</P> Fri, 17 Mar 2017 08:09:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358519#M105984 gcusello 2017-03-17T08:09:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358520#M105985 <P>Of use my answer which does it.</P> Fri, 17 Mar 2017 18:51:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358520#M105985 woodcock 2017-03-17T18:51:05Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358521#M105986 <P>@cusello Oh ! i wish splunk provides us a possibility to write them in one alert ..anyways thank you for letting me know..</P> Fri, 17 Mar 2017 19:40:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358521#M105986 srisplunk12 2017-03-17T19:40:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358522#M105987 <P>It is possible. Did you look at my answer? Follow the link and that's how to do it.</P> Fri, 17 Mar 2017 22:32:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358522#M105987 woodcock 2017-03-17T22:32:06Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358523#M105988 <P>Hi srisplunk12,<BR /> As suggested by Woodcock, you can filter events in your search and using only one crontab, in this way your search runs always but finds events only in the defined window.<BR /> Add to your search:</P> <PRE><CODE>NOT (date_wday="sunday" OR (date_wday="monday" date_hour&lt;2) OR (date_wday="saturday" date_hour&gt;6)) </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sat, 18 Mar 2017 08:55:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358523#M105988 gcusello 2017-03-18T08:55:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358524#M105989 <P>So this is my understanding from the above query..correct me if i am wrong.. <BR /> It would fetch me events from Monday &gt;2 Am through Saturday &lt; 6 AM.</P> Mon, 20 Mar 2017 16:43:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358524#M105989 srisplunk12 2017-03-20T16:43:43Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358525#M105990 <P>@cusello ,@woodcock .. can you please say if my above understanding is correct..</P> Thu, 23 Mar 2017 16:00:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358525#M105990 srisplunk12 2017-03-23T16:00:18Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358526#M105991 <P>Correct, he switched the <CODE>6</CODE> and the <CODE>2</CODE> based on your OP.</P> Thu, 23 Mar 2017 22:24:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358526#M105991 woodcock 2017-03-23T22:24:51Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358527#M105992 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/1406">@woodcock</a> ..so i think this will be my search string to fetch the events from Monday&gt;6 AM to Saturday &lt;2 AM </P> <P>"NOT (date_wday="sunday" OR (date_wday="monday" date_hour&lt;6) OR (date_wday="saturday" date_hour&gt;2))"</P> <P>kindly confirm .</P> Tue, 29 Sep 2020 13:23:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358527#M105992 srisplunk12 2020-09-29T13:23:43Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358528#M105993 <P>Notice the <CODE>NOT</CODE>. You should not have switched the comparitors. It should be this:</P> <PRE><CODE>NOT (date_wday="sunday" OR (date_wday="monday" date_hour&lt;6) OR (date_wday="saturday" date_hour&gt;2)) </CODE></PRE> Fri, 24 Mar 2017 15:17:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358528#M105993 woodcock 2017-03-24T15:17:28Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358529#M105994 <P>@woodcock...the only change i could see in your reply is to remove the " " at the start and end..</P> Fri, 24 Mar 2017 15:58:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358529#M105994 srisplunk12 2017-03-24T15:58:32Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358530#M105995 <P>Never mind. They are the same (you are correct).</P> Fri, 24 Mar 2017 18:12:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358530#M105995 woodcock 2017-03-24T18:12:53Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358531#M105996 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/1406">@woodcock</a> , not to split hairs, but when you replied "not to switch the comparitors" i thought i will need to change the search string similar to this .. NOT (date_wday="sunday" OR (date_wday="monday" date_hour&gt;6) OR (date_wday="saturday" date_hour&lt;2)).. hence had the question..,,thanks for the help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 29 Sep 2020 13:23:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358531#M105996 srisplunk12 2020-09-29T13:23:57Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358532#M105997 <P>I misread the operators in your descriptive text as operators in your search text and posted a hasty answer. Then I noticed my mistake and deleted that update and posted the one that is here now.</P> Fri, 24 Mar 2017 18:52:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358532#M105997 woodcock 2017-03-24T18:52:30Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358533#M105998 <P>ok thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 24 Mar 2017 21:04:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-crontab-running-from-Monday-6-AM-through-Saturday/m-p/358533#M105998 srisplunk12 2017-03-24T21:04:11Z