CRON jobs for alerts

[AdixitSplunk]

Can we set an alert by a cron job for 7:32AM and 9:00AM .
I tried out : 32 7,9 * * 1-5
but its sending at 7:32 and 9:32 AM.
Please suggest .

[rjthibod]

First, why do you include the "1-5" option for day of the month? Are you really trying to limit the search to run on the 1st - 5th of the month?

You cannot do what you ask for in a single cron schedule. You will have to split it up into two separately scheduled items. One for 7:32 and one for 9:00.

32 7 1-5 * *
0 9 1-5 * *

[AdixitSplunk]

For this we need to create two alerts ,is there a way to do the same with one alert only .

[rjthibod]

No, because you can't have two cron schedules under one saved search. You have to create two nearly identical saved searches where the only difference is the Cron schedule and the name/ID.