Execute an alert based on crontab expression

[zony2021]

Hi all,

i need to execute an alert each 2hours from 8AM to 11PM.

I would like the alert to be scheduled 30mn after.

Ex:8h30 10h30 12h30 14h30 16h30 18h30 20h30 22h30.

Thanks for your help.

PS: i tried 30 8,10,12,14,16,18,20,23 * * * but it does not seem to work well.

[zony2021]

Thanks all for your help,

my first input seemed to work also but i did not have certain permissions while creating the alert.

Now it is correct and i got the alert at 12h30 and expecting the next one at 14h30.

Thanks a lot.

[me74fhfd · Accepted solution]

Try to shorten crontab like this:
30 8-22/2 * * *

Other than that, make sure you have a privilege to see alert and test alert SPL in search to make sure its retrieving any number of results, since if it is not you wont get alert. 

[burwell]

Hi. Other than the typo above where you had 23 instead of 22 that cron schedule syntax looks correct.

What is happening exactly for this alert?

You could look in the_internal log for the savedsearch_name= and see if the alert is firing.