Deploy alerts

[Mag2sub]

We need to deploy an app that has lot of alerting objects(scheduled) to remote splunks
The number of alerting searches are a 60+..a scheduling nightmare
We need to build in the crons into the alerts before deployment.

If we have slabs of alerts that need to kick off say 15 as we can spare only 20 cpu cores to searches ...how do we ensure the slabs of 15 seraches do not overlap

for ex: how do i ensure cron */5 * * * * of first 15 does not kick off the same time as */5 * * * * of next slab ... idea being we will package this into the app and will be in hands off mode in the remote splunk..ie avoid intervening at remote splunks

[lukejadamec]

Each search will need its own schedule.

To run a cron schedule every 5 minutes starting at a particular minute use this:

1-59/5 * * * * for minutes 1,6,11,16,etc

2-59/5 * * * * for minutes 2,7,12,17,etcand so on.