Alerting

How to write corn schedule of alerts for every 5 min between 6 am to 11 pm CST everyday in Splunk?

sagar_shubham
Explorer

How to write corn schedule of alerts for every 5 min between 6 am to 11 pm CST everyday in Splunk?
I have written as:
*/5 6-23 * * *

Please suggest if this is correct or not?

0 Karma
1 Solution

sudosplunk
Motivator

*/5 6-23 * * *

alt text

If your goal is to avoid alert from 12:00 A.M. to 6:00 A.M., then you can use default datetime fields in your search to get the results you want.

In your case, try something like this index=idx sourcetype=st (date_hour >= 6 AND date_hour <= 23) |.....

View solution in original post

0 Karma

inventsekar
Ultra Champion

for every 5 min between 6 am to 11 pm everyday.
*/5 6-23 * * *
For CST timezone, i hope, you have set up the splunk server timezone to CST.

For everyone's information...For Cron format learnings...
Example expressions
Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20 * * * 1-5    Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9 AM.

https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/CronExpressions

0 Karma

sudosplunk
Motivator

*/5 6-23 * * *

alt text

If your goal is to avoid alert from 12:00 A.M. to 6:00 A.M., then you can use default datetime fields in your search to get the results you want.

In your case, try something like this index=idx sourcetype=st (date_hour >= 6 AND date_hour <= 23) |.....

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...