Cron expression for splunk alert

[shashi584]

I Want to create one splunk alert where it runs on all weekdays and Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST"

Can you help me with a Cron expression that satisfies the above requirement?

I need the alert to be set up in CST time zone only

[shashi584]

Hi @gcusello 

Thanks for the reply, Yes i tried the below Expression which runs every hour past 30 minutes from Mon-Fri

30 * * * 1-5

However, my requirement is to Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST" which is tricky part and not sure how to set up in CST time zone.

In My preference, if i set up in CST time zone , will that work ?

[gcusello]

Hi @shashi584,

the it isn't possible to setup the timezone in the cron expression, it define the hours of execution, if you have a time in CST or a different timezone it a definition of your system, not of cron.

Ciao.

Giuseppe

[gcusello]

Hi @shashi584,

did you tried with

* * * * 1-5

you have to define the condition for the fifth parameter (1-5) then you can define the dayly frequency, e.g. every hour it could be:

0 * * * 1-5

Ciao.

Giuseppe