Splunk Cron expressions not to trigger alert

[sureshkumaar]

Hi All,

I am looking for a cron expression NOT to trigger alert for a particular period of time on daily basis. Alert is scheduled to run for every 10 minutes.

1:00 AM to 1:15 AM

2:00 AM to 2:15 AM

Kindly help me.

[richgalloway · Accepted solution]

cron does not have a concept of "not".  It only specifies run times, not don't-run times.  If you can't craft a cron expression that excludes undesired times, then consider multiple searches with cron schedules that combine to cover the desired times.  For example:

0/10 0 * * * # Every 10 minutes during hour 0 

15-59/10 1,2 * * * # Every 10 minutes starting at x:15 during hours 1 and 2

0/10 3-23 * * * # Every 10 minutes for the remainder of the day

I use https://crontab.guru/ to test my cron strings.

[sureshkumaar]

Thank you very much @richgalloway i will check this in testing alert and let you know the updates

[sureshkumaar]

@richgalloway Thanks for the quick solution it worked good

[sureshkumaar]

@richgalloway  - Can i get cron expression for the alerts not to trigger on sunday from 12 AM - 8 AM alone?

i tried below but the alerts for remaining days it's not getting triggered as the cron expression is specifically for Sunday alone to not trigger from 12 AM - 8 AM.

10-59/10 08 * * 7

[richgalloway]

As I said in my original reply, cron does not have a concept of "not".  It only specifies run times, not don't-run times.  If you can't describe the schedule in a single cron then you may need multiple instances of the alert with different cron expressions.

10-59/10 8-23 * * 7
10-59/10 * * * 1-6