AppD Archive

Help with Cron Expression for Health rule schedule

CommunityUser
Splunk Employee
Splunk Employee

I am trying to build a cron expression for an HTTP 404 alert we have configured.  We have Qaulsys scans going on every Saturday morning from 12am-3am and i need to build a schedule around this so the alert does not fire in that time frame.  Does anyone have an example of what a cron expression would like like to not include Saturday's from 12am-4am?

Below is my attempt at this but I am not sure this is correct

(start)  0 0 4 ? * 1-6
(end)   0 0 00 ? * 1-6

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Have you got the solution for this. If yes, please share the same.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I worked with AppD support and they provided the below information which has worked for us:


In the example below we needed to EXCLUDE a time frame on a Saturday from Midnight to 4am 

In order to accomplish this we had to actually create two health rules with two different schedules.

The first health rule will be for Saturday and the cron expression example is below:

Start Time = 0 0 4 ? * 7 *

End Time = 59 59 23 ? * 7 *

The second health rule will be for the remaining days Sunday-Friday and that example is below:

Start Time = 0 0 0 ? * 1-6 *

End Time = 59 59 23 ? * 1-6 *

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...