topic Re: Corn job in Splunk Search

Corn job

Santosh2 — Wed, 06 Mar 2024 14:38:21 GMT

Hi all, I set a corn job on alert

my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm

0 0-21, 7-23 5-9 3 1-7

is this corn job correct?? Do I need to do any changes????

Re: Corn job

ITWhisperer — Wed, 06 Mar 2024 15:18:26 GMT

Assuming you mean cron not corn, try checking your expression with something like Crontab.guru - The cron schedule expression generator

Re: Corn job

kiran_panchavat — Wed, 06 Mar 2024 15:19:34 GMT

@Santosh2 As per your query, "my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm".

So, It means the Cron job should run between 7AM to 9 PM correct? In this case, you can try this.

* 7-21 * * *

Hour: 7-21 (Every hour from 7 AM to 9 PM)

Re: Corn job

Santosh2 — Wed, 06 Mar 2024 15:19:36 GMT

I did it it’s saying it won’t run from 9pm to 7 am

but it’s not working

Re: Corn job

kiran_panchavat — Wed, 06 Mar 2024 15:21:57 GMT

@Santosh2 Modify the remaining (month,weekday,weekend etc) as per your requirement.

Re: Corn job

kiran_panchavat — Wed, 06 Mar 2024 15:26:32 GMT

@Santosh2

What you mentioned in the cron job, that is wrong: 0 0-21, 7-23 5-9 3 1-7

Reference:

Cron jobs :
#############

* * * * *

Each * denotes each value.

1. Minute
2. Hour
3. Day
4. Month
5. Weekday

Example: If you want to run a report for everyhour from morning 8'o clock to evening 8'o clock ?

Ans : 00 08-20 * * *

Re: Corn job

Santosh2 — Wed, 06 Mar 2024 17:44:30 GMT

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I don’t want to receive the alert at 10pm, 11pm only.

how can I do that????

Re: Corn job

ITWhisperer — Wed, 06 Mar 2024 17:48:53 GMT

0 0-21 * * *

Re: Corn job

Santosh2 — Wed, 06 Mar 2024 18:06:03 GMT

If I want to exclude only 10pm then what will be the cron job

Re: Corn job

ITWhisperer — Wed, 06 Mar 2024 18:38:55 GMT

https://crontab.guru/#0_0-21,23_*_*_*

0 0-21,23 * * *

Re: Corn job

kiran_panchavat — Wed, 06 Mar 2024 19:20:16 GMT

@Santosh2 Can you try this : * 7-21,0-9,12-21 * * *

Re: Corn job

kiran_panchavat — Wed, 06 Mar 2024 19:21:30 GMT

Hour (7-21,0-9,12-21): The range 7-21 includes hours from 7 AM to 9 PM. The additional ranges 0-9 and 12-21 ensure that hours from midnight to 9 AM and from noon to 9 PM are also included. Therefore, the cron job runs every minute from 7 AM to 9 PM, excluding 10 PM and 11 PM.