Splunk Search

Corn job

Santosh2
Path Finder

Hi all, I set a corn job on alert

my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm

0 0-21, 7-23 5-9 3 1-7

is this corn job correct?? Do I need to do any changes????

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2  

What you mentioned in the cron job, that is wrong: 0 0-21, 7-23 5-9 3 1-7

Reference:

 

Cron jobs :
#############

* * * * *

Each * denotes each value. 

1. Minute
2. Hour
3. Day
4. Month
5. Weekday

Example: If you want to run a report for everyhour from morning 8'o clock to evening 8'o clock ?

Ans : 00 08-20 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Modify the remaining (month,weekday,weekend etc) as per your requirement. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 As per your query, "my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm". 

So, It means the Cron job should run between 7AM to 9 PM correct? In this case, you can try this. 

* 7-21 * * *

Hour: 7-21 (Every hour from 7 AM to 9 PM)

kiran_panchavat_0-1709738361345.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

Santosh2
Path Finder

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I  don’t want to receive the alert at 10pm, 11pm only.

how can I do that????

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 0-21 * * *
0 Karma

Santosh2
Path Finder

If I want to exclude only 10pm then what will be the cron job

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you mean cron not corn, try checking your expression with something like Crontab.guru - The cron schedule expression generator

0 Karma

Santosh2
Path Finder

I did it it’s saying it won’t run from 9pm to 7 am

but it’s not working 

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Can you try this  : * 7-21,0-9,12-21 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

Hour (7-21,0-9,12-21):  The range 7-21 includes hours from 7 AM to 9 PM. The additional ranges 0-9 and 12-21 ensure that hours from midnight to 9 AM and from noon to 9 PM are also included. Therefore, the cron job runs every minute from 7 AM to 9 PM, excluding 10 PM and 11 PM.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...