Alerting

How do I schedule an alert to run every 12 hours?

vrmandadi
Builder

I'm creating an alert.
How can I schedule it to run two times every day?
every 12 hours

Tags (2)
0 Karma
1 Solution

jensonthottian
Contributor

Two times a day, select cron schedule in alert.
0 3,15 * * * ? - That'll run a job at 3am and 3pm. That's twice a day, with 12 hours between.
You could use 0 0/12 * * * ? which means every 12 hours.

View solution in original post

jensonthottian
Contributor

Two times a day, select cron schedule in alert.
0 3,15 * * * ? - That'll run a job at 3am and 3pm. That's twice a day, with 12 hours between.
You could use 0 0/12 * * * ? which means every 12 hours.

martin_mueller
SplunkTrust
SplunkTrust

The answer should be amended - 0 0 3,15 * * is "every 3rd and 15th day of every month, do something at midnight".

The second expression is invalid because the day of month starts with 1, not 0.

jensonthottian
Contributor

Agreed, sorry for the typo

it should be -- 0 3,15 * * * -- for 3am and 3pm everyday of every month.

-- 0 */12 * * * -- which means every 12 hours.

0 Karma

vrmandadi
Builder

i tried using your example it says invalid cron

vrmandadi
Builder

should I leave the earliest and latest columns blank

0 Karma

jensonthottian
Contributor

that depends on the alert sampling, what is the time range you are doing it for. It has no relation with the cron schedule.
Please provide more information on your alert.

0 Karma

vrmandadi
Builder

i want to run at 12 am and 12 pm

0 Karma

jensonthottian
Contributor

0 0 00/12 * * * - Use this in the cron

0 Karma

vrmandadi
Builder

I used this and it worked
0 */12 * * *

jensonthottian
Contributor

Not sure why you voted my answer down, "0 /12 " was in my initial solution.

0 Karma

jensonthottian
Contributor

awesome 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...