Alerting

Cron Expression Stumper- How do I schedule an alert to run every 5 minutes between 9:30-16:00 EST Mon- Fri?

sroderick85
New Member

How do I schedule an alert to run every 5 minutes between the hours of 9:30 and 16:00 Eastern Time Monday-Friday?

Labels (2)
Tags (1)
0 Karma

Taruchit
Contributor

Hi @sroderick85,

*/5 9-16 * * 1-5

The above cron will run every 5 minutes from 9:00 to 16:00, Monday to Friday.

However, I am also unable to build the expression which starts at 9:30 and ends at 16:00

Thank you

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Actually this run between 9:00 - 16:55 not 9:00 - 16:00. That's the reason for last two lines on my previous example. To getting it to run 9:30 - 9:55 you need that 1st line (fixed by adding ,55 to it).
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

i think that you are needing three separate entries.

 

30,35,40,45,50,55 9 * * 1-5
*/5 10-15 * * 1-5
0 16 * * 1-5 

 

another option is create own checker to your script to check times for first half and last hour, but I think that three separate entries are better option.


r. Ismo 

sroderick85
New Member

Am I able to put 3 entries in the same alert?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Unfortunately I think that you must create separate alerts for those.
0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...