Alerting

How to write corn schedule of alerts for every 5 min between 6 am to 11 pm CST everyday in Splunk?

sagar_shubham
Explorer

How to write corn schedule of alerts for every 5 min between 6 am to 11 pm CST everyday in Splunk?
I have written as:
*/5 6-23 * * *

Please suggest if this is correct or not?

0 Karma
1 Solution

sudosplunk
Motivator

*/5 6-23 * * *

alt text

If your goal is to avoid alert from 12:00 A.M. to 6:00 A.M., then you can use default datetime fields in your search to get the results you want.

In your case, try something like this index=idx sourcetype=st (date_hour >= 6 AND date_hour <= 23) |.....

View solution in original post

0 Karma

inventsekar
Super Champion

for every 5 min between 6 am to 11 pm everyday.
*/5 6-23 * * *
For CST timezone, i hope, you have set up the splunk server timezone to CST.

For everyone's information...For Cron format learnings...
Example expressions
Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20 * * * 1-5    Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9 AM.

https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/CronExpressions

>>> Happy Splunking !
0 Karma

sudosplunk
Motivator

*/5 6-23 * * *

alt text

If your goal is to avoid alert from 12:00 A.M. to 6:00 A.M., then you can use default datetime fields in your search to get the results you want.

In your case, try something like this index=idx sourcetype=st (date_hour >= 6 AND date_hour <= 23) |.....

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...