Alerting

Splunk cron expression to accommodate our maintenance window

namrithadeepak
Path Finder

Hi,

I have to schedule a Splunk alert. I want the alert to be triggered if no of results > 10, except during the maintenance window given below,

Monday to Sunday 4 AM to 6 AM
Sunday morning . 00:00 to 6:AM

What cron expression should I use?

Thanks,
namritha

0 Karma

woodcock
Esteemed Legend

You have to use my "short-circuit" or "blackout" approach here, if you really have to keep it as a single search (my answer are the ones that are NOT accepted):
https://answers.splunk.com/answers/24824/can-i-set-a-blackout-period-for-a-scheduled-search-during-w...

0 Karma

somesoni2
Revered Legend

I believe you'd have option to either create two alerts (same search) with crons handling your maintenance window OR handle the maintenance window in the search itself. For option1 you can use two exact same search (different names of course) with following crons: (assuming you run your alert every 10 mins)

cron 1: */10 6-23 * * * (At every 10th minute past every hour from 6 through 23.)
cron 2: */10 0-3 * * 1-6 (At every 10th minute past every hour from 0 through 3 on every day-of-week from Monday through Saturday.)

We'll need your full alert search with alert conditions to suggest something for option 2.

cpetterborg
SplunkTrust
SplunkTrust

You didn't specify the frequency, so I'm going to assume every 5 minutes.

Create two alerts using the same saved search, but you will have to use two different schedules:

*/5 0-3,6-23 * * 1-6
*/5 6-23 * * 0
0 Karma

tmarlette
Motivator

There's no good cron expression for this, as Splunk only allows a single schedule.

the only way I've done safe work times before is using a lookup table, and referencing the date_day / date_hour default fields in it with a | where filter.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...