Alerting

How do I schedule a cron job to run every 6 hours, which should start at a particular time?

varad_joshi
Communicator

I need to start a cron job where I am setting up alerts every 6 hours using * */6 * * * in cron. However I want first alert to get triggered at a particular time. where do I set that?

This could be fairly simple, a newbie here 🙂

Tags (3)
0 Karma
1 Solution

FritzWittwer_ol
Contributor

or you can just use commas:

57 1,7,13,19 * * *

Means on the 57th Minute of the hours 1, 7, 13 and 19

View solution in original post

FritzWittwer_ol
Contributor

or you can just use commas:

57 1,7,13,19 * * *

Means on the 57th Minute of the hours 1, 7, 13 and 19

varad_joshi
Communicator

Like I said it could be fairly simple. One of the colleague @meenal901 also suggested.
Thanks this was helpful.

0 Karma

lloydd518
Path Finder

I don't think cron can quite meet your requirement but I have produced a couple of examples where we can try and manipulate cron which may help you solve your problem..

57 7-23/6 * * *

This schedule runs on the 57th minute of the the hour - between 7am and 11pm every 6 hours... So in splunk it fires at 7:57 13:57 19:57 And back to 7:57 the next day...

00 1-23/6 * * *
This schedule runs at the start of the hour 00min between 1am and 11pm every 6 hours.... So in splunk it fires at 01:00 07:00 13:00 19:00 And back to 01:00 the next day...

00 5-24/6 * * *
This schedule runs at the start of the hour 00min between 5am and 12am every 6 hours.... So in splunk it fires at 05:00 11:00 17:00 23:00 And back to 05:00 the next day...

So this may help you but it can end up missing a period as in the first example which only fired 3 times as opposed to the next 2 examples which fired off 4 times...

Hope this helps...

lloydd518

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...