How can we schedule an alert with irregular times to run?


We have cases where we need to run an alert at 8 am on Monday and at 9 am on Tuesday, meaning, at irregular times.
Is there a way to specify such cases using the cron way or some other method?

Tags (1)
0 Karma

Esteemed Legend

Create a super-set cron covering of all of the times and then add logic to your SPL to short-circuit your search so that it errors on those times that aren't supposed to run. See my unaccepted answer here ( UpVotes appreciated):

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...