Alerting

How do I create an alert using a cron schedule for weekdays as well as weekends?

tkmads1
Explorer

How do I create an alert using cron for following time frame?

Alert should run as follows:

Monday to Friday - 7 AM CST to 7 PM CST
Saturday - 7 AM CST to 4 PM CST

Tags (3)

vishnuedara
New Member

,HI ,

I would like to schedule Cron Job that has period from 6pm of first day to 4 am of second day. I have checked multiple splunk documentations and blogs but couldn't able to find right way to do it. it looks like it takes with in 0-23 hrs of single day.Could some one help with this?

0 Karma

gcato
Contributor

Hi tikmads,

As maciep states it would be easiest to schedule two alerts. Just create one alert, clone it, then alter the cron schedule. You could also use a report for the alert search allowing you to change the saved search (report) in one place.

The cron syntax is:

 0 7-19 * * 1-5  (run hourly, 7am-7pm inclusive, Mon-Fri) 
 0 7-16 * * 6  (run hourly, 7am-4pm inclusive, Saturday)

There are plenty of cron websites out there and Splunk's cron documentation can be found here
http://docs.splunk.com/Documentation/Splunk/6.2.5/Alert/Definescheduledalerts#Use_cron_notation_for_...

It would be possible to have just one alert and then use the search to filter out results based on day and time etc. Look here for an example: http://answers.splunk.com/answers/180682/how-to-write-a-cron-schedule-for-a-single-alert-to.html
Doing this may potentially add unnecessary complication to your search however, and run searches when it's not necessary to.

Hope this helps.

maciep
Champion

my cron skills aren't that good, but instead was wondering why not just make two separate alerts? Since it does seem like those are two different schedules. Just a thought....

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...