Alerting

How to edit my scheduled alert to trigger only once?

raghu0463
Explorer

I was trying to schedule an alert which should trigger only once.
i'm giving the cron schedule as */35 2 * * * (which means it should trigger an alert at 2:35 am when the condition is met. )
but the alert is trigger twice i.e at 2:01 and 2:35.

0 Karma
1 Solution

somesoni2
Revered Legend

You want to run only once per day (based on what you have)? If yes then use like this 35 2 * * *
Use this site to test cron https://crontab.guru/

View solution in original post

somesoni2
Revered Legend

You want to run only once per day (based on what you have)? If yes then use like this 35 2 * * *
Use this site to test cron https://crontab.guru/

raghu0463
Explorer

I have one more doubt, I have scheduled one of my saved search at 4:30 EST, but it triggered an alert at 8:42 EST.

0 Karma

somesoni2
Revered Legend

Run this search and see what is the dispatch time and scheduled time for your alert search

index=_internal sourcetype=scheduler savedsearch_name="Your ALert Search Name here"  status=success 
| table _time *_time | convert ctime(*_time)
0 Karma

raghu0463
Explorer

Thank you, the crontab.guru is very helpful .

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...