I want to create an alert where the saved search has to run every 15 mins in a day, but should not run between 18.30 to 20.30. Can anyone help me with the cron schedule for this? Thank You for your help!
Just schedule it to run every 15 minutes but make sure that it returns 0 results for the forbidden time period like this (you may need to add some equal-signs to the "<" and ">"):
... | where (date_hour<18 AND date_hour>20) OR (date_hour=18 AND date_minute<30) OR (date_hour=20 AND date_minute>30)