AppD Archive

Help with Cron Expression for Health rule schedule

CommunityUser
Splunk Employee
Splunk Employee

I am trying to build a cron expression for an HTTP 404 alert we have configured.  We have Qaulsys scans going on every Saturday morning from 12am-3am and i need to build a schedule around this so the alert does not fire in that time frame.  Does anyone have an example of what a cron expression would like like to not include Saturday's from 12am-4am?

Below is my attempt at this but I am not sure this is correct

(start)  0 0 4 ? * 1-6
(end)   0 0 00 ? * 1-6

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Have you got the solution for this. If yes, please share the same.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I worked with AppD support and they provided the below information which has worked for us:


In the example below we needed to EXCLUDE a time frame on a Saturday from Midnight to 4am 

In order to accomplish this we had to actually create two health rules with two different schedules.

The first health rule will be for Saturday and the cron expression example is below:

Start Time = 0 0 4 ? * 7 *

End Time = 59 59 23 ? * 7 *

The second health rule will be for the remaining days Sunday-Friday and that example is below:

Start Time = 0 0 0 ? * 1-6 *

End Time = 59 59 23 ? * 1-6 *

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...