Splunk cron question

msehic · ‎03-13-2018

What would be the best way to schedule Alert Cron Expression running every 5 min from Sunday 10 AM until Friday 5 PM?

p_gurav · ‎03-13-2018

Try something like:

*/5 10-17 * * 0-5

msehic · ‎03-14-2018

thank you for responding.
I think this would make sense only if you run every day from 10-17 Sun to Fri.
It would not cover for example 17:00 Mon until 10:00 Tuesday.

Only option I see is with 3 cloned alerts running separated times:

*/5 * * * 1-4 -> Monday - Thursday
*/5 0-17 * * 5 -> Friday.
and something on Sunday.

wondering if anyone came up with better idea.

Splunk cron question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Splunk cron question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future