Alerting

How to edit my scheduled alert to trigger only once?

raghu0463
Explorer

I was trying to schedule an alert which should trigger only once.
i'm giving the cron schedule as */35 2 * * * (which means it should trigger an alert at 2:35 am when the condition is met. )
but the alert is trigger twice i.e at 2:01 and 2:35.

0 Karma
1 Solution

somesoni2
Revered Legend

You want to run only once per day (based on what you have)? If yes then use like this 35 2 * * *
Use this site to test cron https://crontab.guru/

View solution in original post

somesoni2
Revered Legend

You want to run only once per day (based on what you have)? If yes then use like this 35 2 * * *
Use this site to test cron https://crontab.guru/

View solution in original post

raghu0463
Explorer

I have one more doubt, I have scheduled one of my saved search at 4:30 EST, but it triggered an alert at 8:42 EST.

0 Karma

somesoni2
Revered Legend

Run this search and see what is the dispatch time and scheduled time for your alert search

index=_internal sourcetype=scheduler savedsearch_name="Your ALert Search Name here"  status=success 
| table _time *_time | convert ctime(*_time)
0 Karma

raghu0463
Explorer

Thank you, the crontab.guru is very helpful .

0 Karma