Cron Schedule

[uhkc777]

I need a cron schedule for following:

executes per every hour excluding from saturday 6pm to sunday 8am?

Thanks in advance,

[somesoni2]

It's not natively available in Splunk CRON. Your options would be

1) create 3 copies of the search,

copy1- run every hour weekday (17 * * * 1-5)
copy2- run every hour before 6pm on sat (17 0-17 * * 6)
copy3- run every hour after 8am on sun (17 8-23 * * 7)

2) Handle non-execution in the search itself using subsearch. Add a subsearch which will check the current hour and day and returns something which will ensure search will not run. E.g.

your base search [| gentimes start=-1 | eval search=case(strftime(now(),"%w")=6 AND strftime(now(),"%H")>=18,"1=2", strftime(now(),"%w")=7 AND strftime(now(),"%H")<8,"1=2", true(),"1=1" | table search ] | rest of the search...

The subsearch will return 1=2 (which will never be true) if the day and hour falls between your maintenance schedule and will return 1=1 otherwise. So your alert will run but will not execute the search fully. Please NOTE that you need to setup your alert condition appropriately.