I think you would need more than one cron expression to cover this sort of time frame and it also depends on how often within this timeframe you want to the alert search to be executed - you might be better off considering building the time constraints, or at least some of it into the search - for example, execute the search every 10 minutes between 2pm and 10am but ignore (remove) results if after 9:30
