There's no good cron expression for this, as Splunk only allows a single schedule.
the only way I've done safe work times before is using a lookup table, and referencing the dateday / datehour default fields in it with a | where filter.
You didn't specify the frequency, so I'm going to assume every 5 minutes.
Create two alerts using the same saved search, but you will have to use two different schedules:
*/5 0-3,6-23 * * 1-6 */5 6-23 * * 0
I believe you'd have option to either create two alerts (same search) with crons handling your maintenance window OR handle the maintenance window in the search itself. For option1 you can use two exact same search (different names of course) with following crons: (assuming you run your alert every 10 mins)
*/10 6-23 * * * (At every 10th minute past every hour from 6 through 23.)
*/10 0-3 * * 1-6 (At every 10th minute past every hour from 0 through 3 on every day-of-week from Monday through Saturday.)
We'll need your full alert search with alert conditions to suggest something for option 2.
You have to use my "short-circuit" or "blackout" approach here, if you really have to keep it as a single search (my answer are the ones that are NOT accepted):