Is there any way to write a corn schedule for a alert which needs to be triggered every 5 min between 6 AM to 11 PM everyday except last week of the month?

[sagar_shubham]

Is there any way to write a corn schedule for a alert which needs to be triggered every 5 min between 6 AM to 11 PM everyday except last week of the month?

I am using this as:
*/5 6-23 1-28 * *

But this did not work as ending weeks can have any of the day.

Need someone's help here.

Thanks

[DavidHourani]

Hi @sagar_shubham,

This is as close as you can get since with cron you cannot configure specific time exceptions without leveraging scripts :

*/5 6-23 1-23 * *

Removing 7 days from a 30 day month so keeping days 1-23. This won't work for 31 day months nor 28 days.

The only solution I see for your problem is to save search 3 times with 3 crons as follows:
1-For 31 days months

 */5 6-23 1-24 1,3,5,7,8,10,12 * 

2- For 30 days months

*/5 6-23 1-23 4,6,9,11 *

3- For February

  */5 6-23 1-21 2 *

That way the total number of jobs would still be the same but you'd get your cron right.
You can use this to test out your crons : https://crontab.guru

Cheers,
David

[sagar_shubham]

Thanks David. In this situation i have to create separate alerts for every conditions you mentioned. But that is not required by the team. Is there any way to manipulate the situation in the query directly?

[DavidHourani]

The alerts would still trigger for the same search and condition, but the timing will be different, making the behavior seemless, since they will never trigger at the same time.

It won't be possible to have a single exclusive cron command for your specific case as it is a limitation with the cron syntax.

[DavidHourani]

Splunk cron documentation is here : https://docs.splunk.com/Documentation/Splunk/7.2.6/Alert/CronExpressions
It's pretty much unchanged from a basic cron.