Alerting

Cron Expression Stumper- How do I schedule an alert to run every 5 minutes between 9:30-16:00 EST Mon- Fri?

sroderick85
New Member

How do I schedule an alert to run every 5 minutes between the hours of 9:30 and 16:00 Eastern Time Monday-Friday?

Labels (2)
Tags (1)
0 Karma

Taruchit
Contributor

Hi @sroderick85,

*/5 9-16 * * 1-5

The above cron will run every 5 minutes from 9:00 to 16:00, Monday to Friday.

However, I am also unable to build the expression which starts at 9:30 and ends at 16:00

Thank you

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Actually this run between 9:00 - 16:55 not 9:00 - 16:00. That's the reason for last two lines on my previous example. To getting it to run 9:30 - 9:55 you need that 1st line (fixed by adding ,55 to it).
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

i think that you are needing three separate entries.

 

30,35,40,45,50,55 9 * * 1-5
*/5 10-15 * * 1-5
0 16 * * 1-5 

 

another option is create own checker to your script to check times for first half and last hour, but I think that three separate entries are better option.


r. Ismo 

sroderick85
New Member

Am I able to put 3 entries in the same alert?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Unfortunately I think that you must create separate alerts for those.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...