Searches, reports, and alerts allows me to enter a CRON schedule with Dual ranges. For instance in the hour field if I do not want to run at 3:00 AM I can use this schedule to run every 15 minutes.
*/15 0-2,4-23 * * *
This is allowed under standard CRON. If instead of editing the CRON schedule in Searches, reports, and alerts I instead try to edit it the REPORTS or ALERTS section of the Splunk App I get an Invalid CRON error. I would attach a picture but it says I need more points.
I've reported this issue as a bug and asked our search and reporting UI folks to investigate. It seems there is a validation issue in the UI, according to one of our cron expression engineers. Thanks for bringing it to our attention! I'll report back with any other updates.
I've asked our engineering team and it is a known bug with 6.1.2. It has been fixed as of 6.1.3. @SplunkShawnCt, if you can upgrade to 6.1.3 or beyond you should be good to go. Let me know if you have further questions on this issue.
I am a tech writer here at Splunk and I've been troubleshooting what sounds like a similar issue with a different app. I'll check with our engineering team to see if it's related.
The other post I've been working on is:
I'll report back with any info I find.
What version of Splunk you're using? Tested the same on 6.2.1 and your cron worked fine "*/15 0-2,4-23 * * *"
Editing the Schedule from Settings -> Searches, reports and alerts works fine for me.
The problem only occurs in the Search & Reporting app when using either the Alerts or Reports tab.
Would you be able to provide a link to the image hosted on another site? A lot of other users do that instead of uploading it directly on here. Also, are you referring to the Search and Reporting App when you say "Splunk App"?
Under Settings if you go to Knowledge -> Searches, reports, and alerts
And select a search there you can enter a CRON schedule that contains two ranges. If you go to the Search App and Click Alerts or Reports and try to edit a CRON Schedule there you will get the error I am talking about. Under dashboards in the search app you can again schedule things on a CRON schedule and have double ranges is valid.
By double ranges I mean two ranges seperated by a comma, (Like in the above picture for the hour field)