I need help on writing cron schedule in Splunk from Sunday 10pm to Saturday 5am every 15 mins.
I have tried below options, but its not working:
/15 22,23,0-5 6-0 : but 6-0 is not allowing on Splunk
/15 22,23,0-5 sun,sat : but this will run on sat 10pm to Sunday 5 am and again Sunday 10pm to Monday 5am.
/15 22,23,0-5 * sun-sat : but sun-sat is not allowing on Splunk.
It is mentioned in the Splunk documentation that "Splunk's cron implementation does not currently support names of months/days. "
I am not a cron expert, but you might have to break that up into multiple cron schedules, e.g. sunday 22-23:45 (/15 22,23 * * 0), monday 12am through Friday 23:45 (/15 * * * 1,2,3,4,5) , Saturday 00-05 (*/15 0,1,2,3,4,5 * * 6)
@maciep : Thanks for your response, but our requirement is to schedule this as one alert. If we break it up into 3 schedules we may result in creating 3 alerts. Do we have any possibility in Splunk to do it as part of same alert or can we give multiple schedules for single alert?
This can't get handling via one cron. You would either need to split it into multiple cron (see answer from @maciep) OR use this workaround for single cron.
Cron:- */15 * * * 0-6
Start: -15m@m , End - @m
Add following to your base search
your base search [| gentimes start=-1 | eval hour=strftime(now(),"%H") | eval day=lower(strftime(now(),"%A")) | eval index=if((day="sunday" AND hour<22) OR (day="saturday" AND hour>=5),"YouWillNotFindThisIndex","*") | table index ] | rest of the search