topic How do you create an alert for different cron schedules? in Splunk Search

How do you create an alert for different cron schedules?

nmohammed — Wed, 29 Aug 2018 20:27:25 GMT

We have 4 tasks that run on different schedules and log an event in the application logs when the job starts. The task is to alert if the job doesn't run on a prescribed schedule. Can this be done with a single search command ?

JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

Event produced in Log -

[2018-08-29 06:00:00,912] {Worker #04283bd8} INFO JobA::Execute - ********************** Job Name : AgedApplicationNotificationJob - started at : 8/29/2018 6:00:00 AM **********************

Thanks

Re: How do you create an alert for different cron schedules?

nmohammed — Wed, 29 Aug 2018 20:29:39 GMT

JobName Cron Schedule
JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

Re: How do you create an alert for different cron schedules?

Shan — Thu, 30 Aug 2018 05:04:01 GMT

@nmohammed,

Yes you can achieve it. If you have Started at as a separate field then by extracting the Hours separately and compare with epoc time. Else you need to write a regex to extract Started at filed and achieve it .

Example: If this job need to start at 4 am but it started at 6 am. lets see how we can check it and trigger a alert.
started at : 8/29/2018 6:00:00 AM. You can write an alert.

   | makeresults 
    | eval data=strftime(strptime("8/29/2018 6:00:00 AM","%m/%d/%Y %H"),"%H")
    | eval calc=if(data=04,1,0)
    | table data calc

Re: How do you create an alert for different cron schedules?

mstjohn_splunk — Thu, 30 Aug 2018 22:36:21 GMT

Hi @nmohammed,

Did the below answer answer your question? If so, please resolve this post by approving the answer below. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂