I would like to schedule Cron Job that has period from 6pm of first day to 4 am of second day. I have checked multiple splunk documentations and blogs but couldn't able to find right way to do it. it looks like it takes with in 0-23 hrs of single day.Could some one help with this?
As maciep states it would be easiest to schedule two alerts. Just create one alert, clone it, then alter the cron schedule. You could also use a report for the alert search allowing you to change the saved search (report) in one place.
The cron syntax is:
0 7-19 * * 1-5 (run hourly, 7am-7pm inclusive, Mon-Fri) 0 7-16 * * 6 (run hourly, 7am-4pm inclusive, Saturday)
There are plenty of cron websites out there and Splunk's cron documentation can be found here
It would be possible to have just one alert and then use the search to filter out results based on day and time etc. Look here for an example: http://answers.splunk.com/answers/180682/how-to-write-a-cron-schedule-for-a-single-alert-to.html
Doing this may potentially add unnecessary complication to your search however, and run searches when it's not necessary to.
Hope this helps.