Alerting

Execute an alert based on crontab expression

zony2021
Engager

Hi all,

i need to execute an alert each 2hours from 8AM to 11PM.

I would like the alert to be scheduled 30mn after.

Ex:8h30 10h30 12h30 14h30 16h30 18h30 20h30 22h30.

Thanks for your help.

PS: i tried 30 8,10,12,14,16,18,20,23 * * * but it does not seem to work well.

Labels (1)
0 Karma
1 Solution

me74fhfd
Path Finder

Try to shorten crontab like this:
30 8-22/2 * * *

Other than that, make sure you have a privilege to see alert and test alert SPL in search to make sure its retrieving any number of results, since if it is not you wont get alert. 

View solution in original post

0 Karma

zony2021
Engager

Thanks all for your help,

my first input seemed to work also but i did not have certain permissions while creating the alert.

Now it is correct and i got the alert at 12h30 and expecting the next one at 14h30.

Thanks a lot.

0 Karma

me74fhfd
Path Finder

Try to shorten crontab like this:
30 8-22/2 * * *

Other than that, make sure you have a privilege to see alert and test alert SPL in search to make sure its retrieving any number of results, since if it is not you wont get alert. 

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Other than the typo above where you had 23 instead of 22 that cron schedule syntax looks correct.

 

What is happening exactly for this alert?

 

You could look in the_internal log for the savedsearch_name= and see if the alert is firing.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...