Cron schedule

[Ash1]

We have an alert where the cron schedule runs for every 6hours

0 */6 * * *

but I don’t want to receive the alert at 6pm only how can I write a corn for that???

[Ash1]

Thank you all

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

You can specify the exact hours you want the alert to run.

0 0,6,12 * * *

[Ash1 · Accepted solution]

Hi @richgalloway , thank you for that.

i have one more question, can u pls help on this

I want a cron where alert should trigger  4 times a day starting from 12am, 6am, 12pm, 6 pm and weekday only at 6am everyday

[marnall]

As richgalloway said, you need 2 separate alerts for 2 separate cron schedules. To make this maintainable, you could make a single Saved Search, then make 2 separate alerts that reference the single Saved Search using the | savedsearch  (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch) 

Each alert will have a cron schedule:

1) 4 times a day starting from 12am, 6am, 12pm, 6 pm (weekends - Sat and Sun)

0 */6 * * 0,6

2) only at 6AM on weekdays (Mon-Fri)

0 6 * * 1-5

For formulating cron schedules, I recommend using the website https://crontab.guru/ as it makes a human-readable schedule at the top.

[richgalloway]

To have different cron schedules you have to clone the alert and set a separate schedule for each copy.