CRON expression

[C14795A]

How would I configure a CRON expression such that an alert was sent 50 minutes past every hour, but only between 7:50am (0750) to 4:50pm (1650) Monday to Friday? And if possible, excluding bank holidays. Thanks.

[ITWhisperer · Accepted solution]

50 7-16 * * 1-5

cron doesn't know about public holidays

[C14795A]

Many thanks for the quick response - much appreciated

[ITWhisperer]

You could try the holidays app from splunkbase to test if the day is a holiday in your alert search

[C14795A]

Will try that - thanks again.

[isoutamo]

Another option is create lookup file where you add those days which you want to exclude and add check from it to your query. If days match you can add something to your SPL to prevent it to give any results.