Alerting

How to setup a Splunk alert to run on 2 different days during 2 different times?

rahulbhatia
Path Finder

Hi All,

 

I have a requirement where i want to setup the alert to run every 10 min on friday between 8-10pm and every 10 min on sunday between 6-8am.

 

i tried writing the Cron for it however it didnt work 

 

Can you please help

Labels (3)
0 Karma

rahulbhatia
Path Finder

15 20-22,6-8 * * 5,0 this is Cron schedule we have used but it is running during the same time on Friday and Sunday 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Which is to be expected with the given cron schedule.  Running at different times on certain days requires multiple cron schedules.  Since Splunk supports a single cron schedule for an alert, you need a separate alert for each cron schedule.  Or, as suggested by @JacekF , you can add intelligence to the alert.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JacekF
Path Finder

I don't think this can be done with a cron schedule only. You can use a cron similar to that one:

*/10 20-22,6-8 * * 5,0

This should execute the alert at every 10th minute past every hour from 20 through 22 and every hour from 6 through 8 on Friday and Sunday. In the SPL you can add a condition to check the day of week and the hour and return results depending on day/hour combination.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know the cron schedule(s) you tried, but I think you'll need two alerts to accomplish that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...