It's not natively available in Splunk CRON. Your options would be
1) create 3 copies of the search,
copy1- run every hour weekday (17 * * * 1-5)
copy2- run every hour before 6pm on sat (17 0-17 * * 6)
copy3- run every hour after 8am on sun (17 8-23 * * 7)
2) Handle non-execution in the search itself using subsearch. Add a subsearch which will check the current hour and day and returns something which will ensure search will not run. E.g.
your base search [| gentimes start=-1 | eval search=case(strftime(now(),"%w")=6 AND strftime(now(),"%H")>=18,"1=2", strftime(now(),"%w")=7 AND strftime(now(),"%H")<8,"1=2", true(),"1=1" | table search ] | rest of the search...
The subsearch will return 1=2 (which will never be true) if the day and hour falls between your maintenance schedule and will return 1=1 otherwise. So your alert will run but will not execute the search fully. Please NOTE that you need to setup your alert condition appropriately.
