Alerting

Can someone help with with a cron expression that runs every 15min from 8:15am to 6pm Monday to Friday?

jackin
Path Finder

Can anyone help on cron expression

Query runs every 15min from 8:15am to 6pm Monday to Friday

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I already told you in https://community.splunk.com/t5/Security/Cron-Expression-for-scheduled-Alert/m-p/575364 - there's no single cron schedule that will cover all the "uneven boundaries".

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

please try this:

*/15 8-18 * * 1-5

Ciao.

Giuseppe

0 Karma

abazgwa21cz
Explorer

How can I configure a CRON expression such that an alert was sent each 2hours in a day, and every day in weeks. ??
Many thanks !!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @abazgwa21cz,

sorry but it isn't so clear:

do you want a cron expression to run alert every 2 hours in a day, an this is clear, but what do you mean with " and every day in a week"?

do you mean every 2 hours in working days (Mon-Fri) and one time in the Week end or what else?

In general, it isn't a good idea attach a new question to another one, because less people will answer you, opening a new question it's better.

Ciao.

Giuseppe

0 Karma

jackin
Path Finder

@gcusello  

Thanks man but

 */15 8-18 * * 1-5

we are running the query evey 15min and it should took last 15min data .It means query started running at 8am it took the data from 7:45am but we need from 8am data. 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

in the cron expression you can only define these parameters, you could exclude data before 8.00 in the main search (e.g. time_hours>7).

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Another option is add additional cron entries for those first/last hours where you are needing other start times than in other hours.
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...