Splunk Search

Corn job

Santosh2
Path Finder

Hi all, I set a corn job on alert

my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm

0 0-21, 7-23 5-9 3 1-7

is this corn job correct?? Do I need to do any changes????

0 Karma

kiran_panchavat
Champion

@Santosh2  

What you mentioned in the cron job, that is wrong: 0 0-21, 7-23 5-9 3 1-7

Reference:

 

Cron jobs :
#############

* * * * *

Each * denotes each value. 

1. Minute
2. Hour
3. Day
4. Month
5. Weekday

Example: If you want to run a report for everyhour from morning 8'o clock to evening 8'o clock ?

Ans : 00 08-20 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Champion

@Santosh2 Modify the remaining (month,weekday,weekend etc) as per your requirement. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Champion

@Santosh2 As per your query, "my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm". 

So, It means the Cron job should run between 7AM to 9 PM correct? In this case, you can try this. 

* 7-21 * * *

Hour: 7-21 (Every hour from 7 AM to 9 PM)

kiran_panchavat_0-1709738361345.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

Santosh2
Path Finder

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I  don’t want to receive the alert at 10pm, 11pm only.

how can I do that????

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 0-21 * * *
0 Karma

Santosh2
Path Finder

If I want to exclude only 10pm then what will be the cron job

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you mean cron not corn, try checking your expression with something like Crontab.guru - The cron schedule expression generator

0 Karma

Santosh2
Path Finder

I did it it’s saying it won’t run from 9pm to 7 am

but it’s not working 

0 Karma

kiran_panchavat
Champion

@Santosh2 Can you try this  : * 7-21,0-9,12-21 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Champion

Hour (7-21,0-9,12-21):  The range 7-21 includes hours from 7 AM to 9 PM. The additional ranges 0-9 and 12-21 ensure that hours from midnight to 9 AM and from noon to 9 PM are also included. Therefore, the cron job runs every minute from 7 AM to 9 PM, excluding 10 PM and 11 PM.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...