Splunk alert are not triggering specific days

[krishna4murali]

A alert is configured to schedulre cron trigger with expression 0 11 * * 1,4.

But its triggering on non specific days, like on Tuesday and Wednseday?

What could be the problem here? i checked using crontab.guru, its showing correct validation.

Thanks In Advance.

[krishna4murali]

We have changed in the desired alert to see if another private clone triggerign the message, but wont know untill Tuesday.. let's wait.

[krishna4murali]

Is there any possibility that with orphaned alerts or kind of? without index in search params?

[gcusello]

Hi @krishna4murali ,

check in the triggered alerts dashboard and/or in the alerts dashboards if the wrong date alerts are from that alerts or from another.

Ciao.

Giuseppe

[PrewinThomas]

@krishna4murali 

That behavior isn't expected—using 0 11 * * 1,4 in your cron schedule should result in the job triggering only at 11:00 AM on Mondays and Thursdays.

Could you confirm: Is the job actually running at 11:00 AM on Tuesdays and Wednesdays, or at any other unexpected times?

Please check: Review the time zone setting on the system host where this cron is configured.

Also for testing try to configure with below just to make sure it's executing as expected or not.

0 12 * * *

Ideally should execute At 12 PM every day, on the hour

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[krishna4murali]

It's running  at unexpected days in the same time

[livehybrid]

Hi @krishna4murali 

Does it run at the expected time of 11:00?

Im wondering if there is an invalid character in the 1,4 part somewhere thats causing it to run everyday. 

Just to clarify, theres no space between the comma and the next digit? No characters after the 4? 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[krishna4murali]

Thanks for reply @livehybrid , 

There are no invalid characters on cron and there is no space between the comma and after last digit.

[livehybrid]

How very strange! 

This might sound funny question - but the alert you are seeing being triggered is definitely the alert you're looking at and that its not a clone of or similar alert?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[krishna4murali]

Nope, its not a clone.

[gcusello]

Hi @krishna4murali ,

which are the days when the alert must be executed?

as you can read at https://it.wikipedia.org/wiki/Crontab, using the cron expression  0 11 * * 1,4 you execute it on Sunday and Wednseday.

Then, check the execution days of your alert, anyway, on Tuesday it shouldn't be executed.

Ciao.

Giuseppe

[krishna4murali]

0 11 * * 1,4 means it should be executed on Monday and Thursdays only accoridng to crontab.guru.

[gcusello]

Hi @krishna4murali ,

yes, sorry, I was wrong: Sunday and Thursday!

anyway, in the triggered alerts dashboard, you can see if the wrong days executions are related to your alert or to another one.

Ciao.

Giuseppe