Monitoring Splunk

Cron expression for alert



I need help with cron expression for the alert so that it should not trigger the alert during the following time interval.


Monday -to- Friday : 9:30 AM to 2:00 PM 

Saturday - Sunday : From 9:30 AM (whole day of saturday ) to Sunday 2:00 PM 

Thank you


Labels (1)
Tags (3)
0 Karma


I think you would need more than one cron expression to cover this sort of time frame and it also depends on how often within this timeframe you want to the alert search to be executed - you might be better off considering building the time constraints, or at least some of it into the search - for example, execute the search every 10 minutes between 2pm and 10am but ignore (remove) results if after 9:30

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!