Alerting

Splunk Cron expressions not to trigger alert

sureshkumaar
Path Finder

Hi All,

I am looking for a cron expression NOT to trigger alert for a particular period of time on daily basis. Alert is scheduled to run for every 10 minutes.

1:00 AM to 1:15 AM

2:00 AM to 2:15 AM

Kindly help me.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

cron does not have a concept of "not".  It only specifies run times, not don't-run times.  If you can't craft a cron expression that excludes undesired times, then consider multiple searches with cron schedules that combine to cover the desired times.  For example:

 

0/10 0 * * * # Every 10 minutes during hour 0 

15-59/10 1,2 * * * # Every 10 minutes starting at x:15 during hours 1 and 2

0/10 3-23 * * * # Every 10 minutes for the remainder of the day

I use https://crontab.guru/ to test my cron strings.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

cron does not have a concept of "not".  It only specifies run times, not don't-run times.  If you can't craft a cron expression that excludes undesired times, then consider multiple searches with cron schedules that combine to cover the desired times.  For example:

 

0/10 0 * * * # Every 10 minutes during hour 0 

15-59/10 1,2 * * * # Every 10 minutes starting at x:15 during hours 1 and 2

0/10 3-23 * * * # Every 10 minutes for the remainder of the day

I use https://crontab.guru/ to test my cron strings.

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

sureshkumaar
Path Finder

Thank you very much @richgalloway i will check this in testing alert and let you know the updates

0 Karma

sureshkumaar
Path Finder

@richgalloway Thanks for the quick solution it worked good

0 Karma

sureshkumaar
Path Finder

@richgalloway  - Can i get cron expression for the alerts not to trigger on sunday from 12 AM - 8 AM alone?

i tried below but the alerts for remaining days it's not getting triggered as the cron expression is specifically for Sunday alone to not trigger from 12 AM - 8 AM.

10-59/10 08 * * 7

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As I said in my original reply, cron does not have a concept of "not".  It only specifies run times, not don't-run times.  If you can't describe the schedule in a single cron then you may need multiple instances of the alert with different cron expressions.

10-59/10 8-23 * * 7
10-59/10 * * * 1-6
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.