Monitoring Splunk

Cron expression for alert



I need help with cron expression for the alert so that it should not trigger the alert during the following time interval.


Monday -to- Friday : 9:30 AM to 2:00 PM 

Saturday - Sunday : From 9:30 AM (whole day of saturday ) to Sunday 2:00 PM 

Thank you


Labels (1)
Tags (3)
0 Karma


I think you would need more than one cron expression to cover this sort of time frame and it also depends on how often within this timeframe you want to the alert search to be executed - you might be better off considering building the time constraints, or at least some of it into the search - for example, execute the search every 10 minutes between 2pm and 10am but ignore (remove) results if after 9:30

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!