Multiple Cron Schedules In One Saved Search

[itsomana]

Is it possible to have more than one cron schedule in a saved search. I have a save search that starts Monday to Saturday at 7:26am and stops at 18:30 Monday, Thursday and Saturday, however on Friday it stops at 17:30.

[woodcock]

Check out my answer in the following link (it is NOT the accepted one) for a way to do this in a single search with a single cron, provided your crons share the same periodicity (timespan between runs):

https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

[woodcock]

You should be able to accept this as the correct answer now.

[gkanapathy]

No. You would have to create multiple saved searches, and configure them the same other than the schedule. They would have to have different names, and could not be used to populate a dashboard, but I assume you're using this to send out an alert, or run a job.

[shawngarrettsgp]

I downvoted this post because there is a more elegant answer to do this in one alert still, rather than creating 3 separate alerts.