Splunk cron question

[msehic]

What would be the best way to schedule Alert Cron Expression running every 5 min from Sunday 10 AM until Friday 5 PM?

[p_gurav]

Try something like:

*/5 10-17 * * 0-5

[msehic]

thank you for responding.
I think this would make sense only if you run every day from 10-17 Sun to Fri.
It would not cover for example 17:00 Mon until 10:00 Tuesday.

Only option I see is with 3 cloned alerts running separated times:

*/5 * * * 1-4 -> Monday - Thursday
*/5 0-17 * * 5 -> Friday.
and something on Sunday.

wondering if anyone came up with better idea.