Security

Cron Expression for scheduled Alert

jackin
Path Finder

Hi 

Please help me to build cron expression. thanks in advance

Alert runs Every 15min from 8am to 18pm, Everyday
Alert runs Every 15min from 4am to 18pm weekdays only
Alert runs Every 15min from 8am to 18pm weekdays only
Alert runs Every 15min from 9am to 17pm weekdays only
Alert runs Every 15min from 8am to 18:45pm weekdays only
Alert runs Every 15min from 23:01 pm to 18:59pm Everyday
Alert runs Every 15min from 12am to 12:59am and 6am to 6:59am Everyday
Alert runs Every 15min from 8am to 8:59am and 13pm to 13:59pm Everyday
Alert runs Every 15min from 10am to 6:59am Everyday
Alert runs Every 15min from 7am to 23:59pm Everyday
Alert runs Every 15min from 8am to 10:59am Everyday
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can't write some of them as a single cron schedule.

For example - if your frequency is "every 15 minutes", you can't run it from something :00 till something else :59. Your latest occurrence would be :45, not :59.

Amd, since you can only specify how each datetime part changes on it's own, you can't do "every 15 minutes from something :00 up to and including something else :00". If you specify both ranges/generators or whatever you call them for hours and for minutes they will both get expanded separately.

So

*/15 7-9

(To only focus on minutes and hours, forget the other parts of cron spec)

will generate times from 7:00 up to 9:45. There is no way to include just 10:00 without 10:15, 10:30 and 10:45.

You'd neeed a separate schedule just for 10:00.

0 Karma

jackin
Path Finder

Thankq @PickleRick 

 

Can you help in below updated sheet

Alert Every 15min from 8am to 18pm Everyday
Alert Every 15min from 4am to 18pm weekdays only
Alert Every 15min from 8am to 18pm weekdays only
Alert Every 15min from 9am to 17pm weekdays only
Alert Every 15min from 8am to 18:45pm weekdays only
Alert Every 15min from 23:00 pm to 19pm
Alert Every 15min from 12am to 1am 
Alert Every 15min from 6am to 7am
Alert Every 15min from 8am to 9am
Alert Every 15min from 13pm to 2pm
Alert Every 15min from 10am to 7am
Alert Every 15min from 7am to 12am
Alert Every 15min from 8am to 11am
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...