Is it possible for a cron job to run for events from the previous 24 hours?

[demkic]

Hi, is it possible to run a cron job with the following schedule: 15 7-23/6 *** but have it run for events that happened only in the last 24 hours?

Many thanks!
Daria

[DalJeanis · Accepted solution]

Sure. I read that as, you want it to run daily at 7:15 AM, 1:15 PM, and 7:15 PM. (7-23/6 equates to 7, 13,and 20 - if you want it to run 4 times in between 7 and 23, you'd need to change that to every 5 hours and it would hit 7,12,17 and 22.)

So, just to be clear: For example, when it runs at 7:15 am, do you want it to check all the events from 7:15 the prior day to 7:15 this day? You would just have the search code's earliest value set to either =-24h or =-1d.

Since you're willing to schedule it only every 6 hours, it might be advantageous to use =-1d@h and latest= =@h, so that the 7:15 AM search checks from 7:00 AM the prior day to 7:00 AM the current day.

[demkic]

This is great, thank you for your feedback. I didn't notice that I was able to state a custom time (earliest and latest) within the alert itself.

[DalJeanis]

Yup, an alert just a search that's fit into a special pigeonhole named "alert", so you have most features available to an alert that you have to any other search.