Reporting

CRON jobs for alerts

AdixitSplunk
Path Finder

Can we set an alert by a cron job for 7:32AM and 9:00AM .
I tried out : 32 7,9 * * 1-5
but its sending at 7:32 and 9:32 AM.
Please suggest .

Tags (2)
0 Karma

rjthibod
Champion

First, why do you include the "1-5" option for day of the month? Are you really trying to limit the search to run on the 1st - 5th of the month?

You cannot do what you ask for in a single cron schedule. You will have to split it up into two separately scheduled items. One for 7:32 and one for 9:00.

32 7 1-5 * *
0 9 1-5 * *

0 Karma

AdixitSplunk
Path Finder

For this we need to create two alerts ,is there a way to do the same with one alert only .

0 Karma

rjthibod
Champion

No, because you can't have two cron schedules under one saved search. You have to create two nearly identical saved searches where the only difference is the Cron schedule and the name/ID.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!