How to set up cron to run search out of working hours?

[woodentree]

Hello,

We would like to run a correlation search every 15 minutes but only out of working hours. It means from 6pm to 8am on weekdays and 24 hours on weekends. We thought about the cron below:

14-59/15 18-23,0-7 * * *

However, in this case, we do not cover 8am-6pm scope on weekends, which is not good. Do you have an idea which cron we should use?

Thanks for the help.

[gcusello]

Hi @woodentree,
the easiest way is to use a cron every 15 minutes ( */15 * * * * ) and manage the exclusions in the search adding to the main search:

(NOT (date_wday=Sunday OR date_wday=Saturday) date_hour>17 date_hour<8)

but in this way you don't manage the holydays.

To manage holydays, you have to create a calendar lookup and use it for the exclusions.

Ciao.
Giuseppe

[woodentree]

Hi @gcusello,

Thanks for the help.

I’m afraid it will not work for us. Most of our correlation searches uses tstats with avg , sum or count functions.

[nickhills · Accepted solution]

One option is schedule two searches - one for weekdays, and one for weekends.
14-59/15 18-23,0-7 * * 1-5 for weekdays
and
14-59/15 * * * 6-7 for weekends

[woodentree]

Hi @nickhillscpl ,

Appreciate your help.

It could be a workaround but I’m afraid not the best one for our circumstances. It will add an additional complexity to maintain a third party inventory tool we have to list our searches in, to set up reporting for management, etc.). Do you know if there is a way to do it in one search?

Thanks.

[nickhills]

In that case, use the solution below from @gcusello !

[woodentree]

Like I've just answered to @gcusello, it looks like it will not be possible for our searches 😞