Alerting
Highlighted

Splunk cron expression to accommodate our maintenance window

Path Finder

Hi,

I have to schedule a Splunk alert. I want the alert to be triggered if no of results > 10, except during the maintenance window given below,

Monday to Sunday 4 AM to 6 AM
Sunday morning . 00:00 to 6:AM

What cron expression should I use?

Thanks,
namritha

0 Karma
Highlighted

Re: Splunk cron expression to accommodate our maintenance window

Motivator

There's no good cron expression for this, as Splunk only allows a single schedule.

the only way I've done safe work times before is using a lookup table, and referencing the dateday / datehour default fields in it with a | where filter.

0 Karma
Highlighted

Re: Splunk cron expression to accommodate our maintenance window

SplunkTrust
SplunkTrust

You didn't specify the frequency, so I'm going to assume every 5 minutes.

Create two alerts using the same saved search, but you will have to use two different schedules:

*/5 0-3,6-23 * * 1-6
*/5 6-23 * * 0
0 Karma
Highlighted

Re: Splunk cron expression to accommodate our maintenance window

SplunkTrust
SplunkTrust

I believe you'd have option to either create two alerts (same search) with crons handling your maintenance window OR handle the maintenance window in the search itself. For option1 you can use two exact same search (different names of course) with following crons: (assuming you run your alert every 10 mins)

cron 1: */10 6-23 * * * (At every 10th minute past every hour from 6 through 23.)
cron 2: */10 0-3 * * 1-6 (At every 10th minute past every hour from 0 through 3 on every day-of-week from Monday through Saturday.)

We'll need your full alert search with alert conditions to suggest something for option 2.

Highlighted

Re: Splunk cron expression to accommodate our maintenance window

Esteemed Legend

You have to use my "short-circuit" or "blackout" approach here, if you really have to keep it as a single search (my answer are the ones that are NOT accepted):
https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

0 Karma