Alerting

How to set up cron schedule every 5 mins everyday except between 4 am to 6am

shilpa02
New Member

Hi,
We have outage every morning between 4 am to 6am. Don't want the splunk logs to run between this time..
I tried using this .
*/5 0-4,6-23 * * *
But this might not include 11pm to 12 am

Please suggest
Thanks

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

That should work fine I would say, except that you need to change the 4 to a 3: */5 0-3,6-23 * * *. See for example: http://cron.schlitt.info/index.php?cron=*%2F15+0-4%2C6-23+*+*+*&iterations=100&test=Test
Note: I changed the example on that site to 15min, to show multiple days as that site is limited to 100 iterations for the test output.

View solution in original post

0 Karma

FrankVl
Ultra Champion

That should work fine I would say, except that you need to change the 4 to a 3: */5 0-3,6-23 * * *. See for example: http://cron.schlitt.info/index.php?cron=*%2F15+0-4%2C6-23+*+*+*&iterations=100&test=Test
Note: I changed the example on that site to 15min, to show multiple days as that site is limited to 100 iterations for the test output.

0 Karma

shilpa02
New Member

Would this include 11pm to 12 am?
And can you please share the reason for 0-3 ?

0 Karma

FrankVl
Ultra Champion

I think you might be misunderstanding how cron syntax works.

*/5 0-3 does not mean every 5 minutes from 0 till 3. It means every 5 minutes for any hour matching 0, 1, 2, 3. So effectively, that is 0:00 - 3:55. Same for the 23 at the end, that means last run of the day is at 23:55.

And that is also why you should not include the 4, as that stretches it to run from 0:00 - 4:55.

0 Karma

shilpa02
New Member

Thank you so much Frank for the extended answers. This helps a lot.

0 Karma

shilpa02
New Member

Thanks Frank for the response.
Can you please share the reason for 0-3 instead of 0-4..
Also, would this include the ties between 11pm to 12 am as well ?
Appreciate your response.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...