Alerting

Cron expression for splunk alert

shashi584
Explorer

I Want to create one splunk alert where it runs on all weekdays and Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST"

Can you help me with a Cron expression that satisfies the above requirement?

I need the alert to be set up in CST time zone only

 

Labels (1)
0 Karma

shashi584
Explorer

Hi @gcusello 

 

Thanks for the reply, Yes i tried the below Expression which runs every hour past 30 minutes from Mon-Fri

30 * * * 1-5

However, my requirement is to Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST" which is tricky part and not sure how to set up in CST time zone.

 

In My preference, if i set up in CST time zone , will that work ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shashi584,

the it isn't possible to setup the timezone in the cron expression, it define the hours of execution, if you have a time in CST or a different timezone it a definition of your system, not of cron.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @shashi584,

did you tried with

* * * * 1-5

you have to define the condition for the fifth parameter (1-5) then you can define the dayly frequency, e.g. every hour it could be:

0 * * * 1-5

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...