topic Re: Cron schedule in Splunk Search

Cron schedule

Ash1 — Sat, 23 Mar 2024 19:46:45 GMT

We have an alert where the cron schedule runs for every 6hours

0 */6 * * *

but I don’t want to receive the alert at 6pm only how can I write a corn for that???

Re: Cron schedule

richgalloway — Sat, 23 Mar 2024 20:08:38 GMT

You can specify the exact hours you want the alert to run.

0 0,6,12 * * *

Re: Cron schedule

Ash1 — Sat, 23 Mar 2024 20:16:19 GMT

Hi @richgalloway , thank you for that.

i have one more question, can u pls help on this

I want a cron where alert should trigger 4 times a day starting from 12am, 6am, 12pm, 6 pm and weekday only at 6am everyday

Re: Cron schedule

richgalloway — Sat, 23 Mar 2024 23:42:12 GMT

To have different cron schedules you have to clone the alert and set a separate schedule for each copy.

Re: Cron schedule

marnall — Sun, 24 Mar 2024 10:21:05 GMT

As richgalloway said, you need 2 separate alerts for 2 separate cron schedules. To make this maintainable, you could make a single Saved Search, then make 2 separate alerts that reference the single Saved Search using the | savedsearch (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch)

Each alert will have a cron schedule:

1) 4 times a day starting from 12am, 6am, 12pm, 6 pm (weekends - Sat and Sun)

0 */6 * * 0,6

2) only at 6AM on weekdays (Mon-Fri)

0 6 * * 1-5

For formulating cron schedules, I recommend using the website https://crontab.guru/ as it makes a human-readable schedule at the top.

Re: Cron schedule

Ash1 — Tue, 26 Mar 2024 21:37:08 GMT

Thank you all

Re: Cron schedule

richgalloway — Tue, 26 Mar 2024 23:52:46 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.