Splunk Search

Cron schedule

Ash1
Communicator

We have an alert where the cron schedule runs for every 6hours

0 */6 * * *

but I don’t want to receive the alert at 6pm only how can I write a corn for that???

0 Karma
1 Solution

Ash1
Communicator

Hi @richgalloway , thank you for that.

i have one more question, can u pls help on this

I want a cron where alert should trigger  4 times a day starting from 12am, 6am, 12pm, 6 pm and weekday only at 6am everyday

View solution in original post

0 Karma

Ash1
Communicator

Thank you all

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can specify the exact hours you want the alert to run.

0 0,6,12 * * *
---
If this reply helps you, Karma would be appreciated.

Ash1
Communicator

Hi @richgalloway , thank you for that.

i have one more question, can u pls help on this

I want a cron where alert should trigger  4 times a day starting from 12am, 6am, 12pm, 6 pm and weekday only at 6am everyday

0 Karma

marnall
Motivator

As richgalloway said, you need 2 separate alerts for 2 separate cron schedules. To make this maintainable, you could make a single Saved Search, then make 2 separate alerts that reference the single Saved Search using the | savedsearch  (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch

Each alert will have a cron schedule:

1) 4 times a day starting from 12am, 6am, 12pm, 6 pm (weekends - Sat and Sun)

0 */6 * * 0,6

2) only at 6AM on weekdays (Mon-Fri)

0 6 * * 1-5

For formulating cron schedules, I recommend using the website https://crontab.guru/ as it makes a human-readable schedule at the top.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To have different cron schedules you have to clone the alert and set a separate schedule for each copy.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...