Splunk cron expression to accommodate our maintenance window

[namrithadeepak]

Hi,

I have to schedule a Splunk alert. I want the alert to be triggered if no of results > 10, except during the maintenance window given below,

Monday to Sunday 4 AM to 6 AM
Sunday morning . 00:00 to 6:AM

What cron expression should I use?

Thanks,
namritha

[woodcock]

You have to use my "short-circuit" or "blackout" approach here, if you really have to keep it as a single search (my answer are the ones that are NOT accepted):
https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

[somesoni2]

I believe you'd have option to either create two alerts (same search) with crons handling your maintenance window OR handle the maintenance window in the search itself. For option1 you can use two exact same search (different names of course) with following crons: (assuming you run your alert every 10 mins)

cron 1: */10 6-23 * * * (At every 10th minute past every hour from 6 through 23.)
cron 2: */10 0-3 * * 1-6 (At every 10th minute past every hour from 0 through 3 on every day-of-week from Monday through Saturday.)

We'll need your full alert search with alert conditions to suggest something for option 2.

[cpetterborg]

You didn't specify the frequency, so I'm going to assume every 5 minutes.

Create two alerts using the same saved search, but you will have to use two different schedules:

*/5 0-3,6-23 * * 1-6
*/5 6-23 * * 0

[tmarlette]

There's no good cron expression for this, as Splunk only allows a single schedule.

the only way I've done safe work times before is using a lookup table, and referencing the date_day / date_hour default fields in it with a | where filter.