Reporting

Scheduled save search in every 30 minutes past 2 mins

Engager

How to run a saved search for every 2 minute in 30 minutes interval (i.e) it should run at 2.02, 2.32, 3.02, 3.32. I tried this 2/30 * * * *, but it is showing as invalid format

Labels (1)
• saved search

Tags (2)
1 Solution
Ultra Champion

If you are asking about a cron schedule, you can use this:
`2,32 * * * *`

Which means, run 2 AND 32 minutes past every hour, (every day of the month, every month, every day of the week)

To elaborate further, if you only wanted this to run during business hours, you could use
`2,32 9-17 * * *`
Which then says 2 & 32 minutes past every hour between 09 - 17

The `/` notation allows you to set repeats. If you wanted something to run every 17 (!?) minutes every 9 hours, it would be:
`*/17 */9 * * *`

If my comment helps, please give it a thumbs up!
Motivator

@rekakumaresan You were close. Comma, not slash. The following cron job will run on minutes 2 and 32 every hour, like in the example you gave.
`2,32 * * * *`

While it can't solve 100% of scenarios, for a majority of cron expression testing, try sites like crontab.guru:
https://crontab.guru/#2,32_*_*_*_*

###

If this reply helps you, an upvote would be appreciated.
Ultra Champion

If you are asking about a cron schedule, you can use this:
`2,32 * * * *`

Which means, run 2 AND 32 minutes past every hour, (every day of the month, every month, every day of the week)

To elaborate further, if you only wanted this to run during business hours, you could use
`2,32 9-17 * * *`
Which then says 2 & 32 minutes past every hour between 09 - 17

The `/` notation allows you to set repeats. If you wanted something to run every 17 (!?) minutes every 9 hours, it would be:
`*/17 */9 * * *`

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...