Splunk Search

Corn job

Santosh2
Path Finder

Hi all, I set a corn job on alert

my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm

0 0-21, 7-23 5-9 3 1-7

is this corn job correct?? Do I need to do any changes????

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2  

What you mentioned in the cron job, that is wrong: 0 0-21, 7-23 5-9 3 1-7

Reference:

 

Cron jobs :
#############

* * * * *

Each * denotes each value. 

1. Minute
2. Hour
3. Day
4. Month
5. Weekday

Example: If you want to run a report for everyhour from morning 8'o clock to evening 8'o clock ?

Ans : 00 08-20 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Modify the remaining (month,weekday,weekend etc) as per your requirement. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 As per your query, "my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm". 

So, It means the Cron job should run between 7AM to 9 PM correct? In this case, you can try this. 

* 7-21 * * *

Hour: 7-21 (Every hour from 7 AM to 9 PM)

kiran_panchavat_0-1709738361345.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

Santosh2
Path Finder

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I  don’t want to receive the alert at 10pm, 11pm only.

how can I do that????

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 0-21 * * *
0 Karma

Santosh2
Path Finder

If I want to exclude only 10pm then what will be the cron job

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you mean cron not corn, try checking your expression with something like Crontab.guru - The cron schedule expression generator

0 Karma

Santosh2
Path Finder

I did it it’s saying it won’t run from 9pm to 7 am

but it’s not working 

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Can you try this  : * 7-21,0-9,12-21 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

Hour (7-21,0-9,12-21):  The range 7-21 includes hours from 7 AM to 9 PM. The additional ranges 0-9 and 12-21 ensure that hours from midnight to 9 AM and from noon to 9 PM are also included. Therefore, the cron job runs every minute from 7 AM to 9 PM, excluding 10 PM and 11 PM.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...