Splunk Search

Corn job

Santosh2
Path Finder

Hi all, I set a corn job on alert

my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm

0 0-21, 7-23 5-9 3 1-7

is this corn job correct?? Do I need to do any changes????

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2  

What you mentioned in the cron job, that is wrong: 0 0-21, 7-23 5-9 3 1-7

Reference:

 

Cron jobs :
#############

* * * * *

Each * denotes each value. 

1. Minute
2. Hour
3. Day
4. Month
5. Weekday

Example: If you want to run a report for everyhour from morning 8'o clock to evening 8'o clock ?

Ans : 00 08-20 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Modify the remaining (month,weekday,weekend etc) as per your requirement. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 As per your query, "my alert should not trigger between 9pm to 7am I used below corn job but I am receiving alerts after 9pm". 

So, It means the Cron job should run between 7AM to 9 PM correct? In this case, you can try this. 

* 7-21 * * *

Hour: 7-21 (Every hour from 7 AM to 9 PM)

kiran_panchavat_0-1709738361345.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

Santosh2
Path Finder

Hi @kiran_panchavat , yes your are correct but my requirement is in 24 hours I  don’t want to receive the alert at 10pm, 11pm only.

how can I do that????

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 0-21 * * *
0 Karma

Santosh2
Path Finder

If I want to exclude only 10pm then what will be the cron job

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you mean cron not corn, try checking your expression with something like Crontab.guru - The cron schedule expression generator

0 Karma

Santosh2
Path Finder

I did it it’s saying it won’t run from 9pm to 7 am

but it’s not working 

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@Santosh2 Can you try this  : * 7-21,0-9,12-21 * * *

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

Hour (7-21,0-9,12-21):  The range 7-21 includes hours from 7 AM to 9 PM. The additional ranges 0-9 and 12-21 ensure that hours from midnight to 9 AM and from noon to 9 PM are also included. Therefore, the cron job runs every minute from 7 AM to 9 PM, excluding 10 PM and 11 PM.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...