How can we schedule an alert with irregular times to run?

[danielbb]

We have cases where we need to run an alert at 8 am on Monday and at 9 am on Tuesday, meaning, at irregular times.
Is there a way to specify such cases using the cron way or some other method?

[woodcock]

Create a super-set cron covering of all of the times and then add logic to your SPL to short-circuit your search so that it errors on those times that aren't supposed to run. See my unaccepted answer here ( UpVotes appreciated):

https://answers.splunk.com/answers/172541/is-it-possible-to-purposely-cause-a-scheduled-sear.html