How can I schedule a cron job only once? For example, the alert should stop once a condition is triggered

[wanda619]

right now i have a cron expression like this - 0 * * * *

so the report is sent out every hour. How can i generate the report only once when the condition is triggered.

Thanks! 

[gcusello]

Hi @wanda619,

as @johnhuang said, you can set your alert to send only one message when the alert fires and not one for each result you have in your alert.

If you don't want to receive messages for a predefined time period after a firing, you can set the throttle.

Ciao.

Giuseppe

[wanda619]

@gcusello right now the alert is set in such way that report is being sent every hour, i am trying to find a way ,so that it sends one report per day.  cron expression i am using is 0 * * * *

[gcusello]

Hi @wanda619,

if you see in the panel where you set the cron schedule, there's an option to throttle events (it's a check flag).

Flagging it you can say to Splunk that if an alert is fired, the alert must be runned again after 24 hours.

Ciao.

Giuseppe

[richgalloway]

To limit the number of alerts to one per day, use the Throttle feature.  Edit the alert, check the "Throttle" box, then set the "Suppress triggering for" settings as shown.  Then click Save.

BTW, try to avoid scheduling alerts at minute 0.  This tends to be the most popular time for running searches so you risk searches being skipped if there aren't enough resources available.

[johnhuang]

Not sure if you want one time use alert or one alert per run. For the latter: configure the Trigger to "Once" which will limit the alert to one per run.

[wanda619]

@johnhuang yes specifically looking for one time use alert,, since now it i giving alert every hour. I am looking to set alert once at the beginning