Alerting

Is it possible to configure more than 1 cron for one alert?

praddasg
Path Finder

Is it possible to configure more than 1 cron for one alert? some thing like */2 9-11,11-13 * * 1-4,5-1, i think the answer is no but wanted reconfirm. The reason i want to know is because alert condition is same but the triggering times will differ based upon day and hours

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

hi @praddasg,
let me understand: you want to run your alert:

  • every two minutes,
  • from Sunday to Wednesday from 9.00 to 11.00
  • from Thursday to Saturday from 11.00 to 13.00

is it correct?

Anyway, you cannot configure two crons, you have two workarounds:

  • create two alerts, with its own cron,
  • manage the condition in the search (using date_wday and date_hour fields).

Ciao.
Giuseppe

View solution in original post

woodcock
Esteemed Legend

You can use my unaccepted answer here to do what you need. Please do UpVote my answer because it is better than the accepted answer, which is wrong and says that it cannot be done (it can):
https://answers.splunk.com/answers/172541/is-it-possible-to-purposely-cause-a-scheduled-sear.html

gcusello
Legend

hi @praddasg,
let me understand: you want to run your alert:

  • every two minutes,
  • from Sunday to Wednesday from 9.00 to 11.00
  • from Thursday to Saturday from 11.00 to 13.00

is it correct?

Anyway, you cannot configure two crons, you have two workarounds:

  • create two alerts, with its own cron,
  • manage the condition in the search (using date_wday and date_hour fields).

Ciao.
Giuseppe

praddasg
Path Finder

Hello @gcusello
Can you help me with the syntax if i want to use date_wday and date_hour

0 Karma

gcusello
Legend

hi @praddasg,
try a condition like this:

index=_internal (((date_wday=sunday OR date_wday="monday" OR date_wday="thursday" OR date_wday="wednesday") (date_hour>8 date_hour<12)) OR ((date_wday="tuesday" OR date_wday="friday" OR date_wday="saturday") (date_hour>10 date_hour<14)))

Then you can schedule your alert every two minutes.

Ciao.
Giuseppe

0 Karma

praddasg
Path Finder

Hello @gcusello Thank you. I think i can use this

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>