Alerting

Why is my alert not running?

ASISH_9
Engager

I scheduled a search Alert with cron expression="48 11 * * 1-5",Although in search it is working fine but it is not working as an alert.Is there any problem with my search query or Alert configuration?Please suggest

Tags (1)
0 Karma
1 Solution

DanielASG
Explorer

this Cron expression does not look right

how often did you want this to run

for every 15min use

0 0/15 * 1/1 * ? *

View solution in original post

kmaron
Motivator

It looks like your Cron schedule is off

Splunk has some really great documentation on how to format your Cron schedule:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/Definescheduledalerts#Using_cron_expressions

0 Karma

DanielASG
Explorer

this Cron expression does not look right

how often did you want this to run

for every 15min use

0 0/15 * 1/1 * ? *
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...