How do I create an alert using a cron schedule for weekdays as well as weekends?

[tkmads1]

How do I create an alert using cron for following time frame?

Alert should run as follows:

Monday to Friday - 7 AM CST to 7 PM CST
Saturday - 7 AM CST to 4 PM CST

[vishnuedara]

,HI ,

I would like to schedule Cron Job that has period from 6pm of first day to 4 am of second day. I have checked multiple splunk documentations and blogs but couldn't able to find right way to do it. it looks like it takes with in 0-23 hrs of single day.Could some one help with this?

[gcato]

Hi tikmads,

As maciep states it would be easiest to schedule two alerts. Just create one alert, clone it, then alter the cron schedule. You could also use a report for the alert search allowing you to change the saved search (report) in one place.

The cron syntax is:

 0 7-19 * * 1-5  (run hourly, 7am-7pm inclusive, Mon-Fri) 
 0 7-16 * * 6  (run hourly, 7am-4pm inclusive, Saturday)

There are plenty of cron websites out there and Splunk's cron documentation can be found here
http://docs.splunk.com/Documentation/Splunk/6.2.5/Alert/Definescheduledalerts#Use_cron_notation_for_...

It would be possible to have just one alert and then use the search to filter out results based on day and time etc. Look here for an example: http://answers.splunk.com/answers/180682/how-to-write-a-cron-schedule-for-a-single-alert-to.html
Doing this may potentially add unnecessary complication to your search however, and run searches when it's not necessary to.

Hope this helps.

[maciep]

my cron skills aren't that good, but instead was wondering why not just make two separate alerts? Since it does seem like those are two different schedules. Just a thought....