Archive

Cron Schedule

Explorer

I need a cron schedule for following:

executes per every hour excluding from saturday 6pm to sunday 8am?

Thanks in advance,

Tags (1)
0 Karma

Revered Legend

It's not natively available in Splunk CRON. Your options would be

1) create 3 copies of the search,

copy1- run every hour weekday (17 * * * 1-5)
copy2- run every hour before 6pm on sat (17 0-17 * * 6)
copy3- run every hour after 8am on sun (17 8-23 * * 7)

2) Handle non-execution in the search itself using subsearch. Add a subsearch which will check the current hour and day and returns something which will ensure search will not run. E.g.

your base search [| gentimes start=-1 | eval search=case(strftime(now(),"%w")=6 AND strftime(now(),"%H")>=18,"1=2", strftime(now(),"%w")=7 AND strftime(now(),"%H")<8,"1=2", true(),"1=1" | table search ] | rest of the search...

The subsearch will return 1=2 (which will never be true) if the day and hour falls between your maintenance schedule and will return 1=1 otherwise. So your alert will run but will not execute the search fully. Please NOTE that you need to setup your alert condition appropriately.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!