Alerting

Cron expression for splunk alert

shashi584
Explorer

I Want to create one splunk alert where it runs on all weekdays and Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST"

Can you help me with a Cron expression that satisfies the above requirement?

I need the alert to be set up in CST time zone only

 

Labels (1)
0 Karma

shashi584
Explorer

Hi @gcusello 

 

Thanks for the reply, Yes i tried the below Expression which runs every hour past 30 minutes from Mon-Fri

30 * * * 1-5

However, my requirement is to Pause at "Friday 11:59 PM CST " and resume at Sunday 11:59 PM CST" which is tricky part and not sure how to set up in CST time zone.

 

In My preference, if i set up in CST time zone , will that work ?

0 Karma

gcusello
Legend

Hi @shashi584,

the it isn't possible to setup the timezone in the cron expression, it define the hours of execution, if you have a time in CST or a different timezone it a definition of your system, not of cron.

Ciao.

Giuseppe

gcusello
Legend

Hi @shashi584,

did you tried with

* * * * 1-5

you have to define the condition for the fifth parameter (1-5) then you can define the dayly frequency, e.g. every hour it could be:

0 * * * 1-5

Ciao.

Giuseppe

 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>