Splunk Search

How do you create an alert for different cron schedules?

nmohammed
Contributor

We have 4 tasks that run on different schedules and log an event in the application logs when the job starts. The task is to alert if the job doesn't run on a prescribed schedule. Can this be done with a single search command ?

JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

Event produced in Log -

[2018-08-29 06:00:00,912] {Worker #04283bd8} INFO JobA::Execute - ********************** Job Name : AgedApplicationNotificationJob - started at : 8/29/2018 6:00:00 AM **********************

Thanks

0 Karma

shankarananth
Builder

@nmohammed,

Yes you can achieve it. If you have Started at as a separate field then by extracting the Hours separately and compare with epoc time. Else you need to write a regex to extract Started at filed and achieve it .

Example: If this job need to start at 4 am but it started at 6 am. lets see how we can check it and trigger a alert.
started at : 8/29/2018 6:00:00 AM. You can write an alert.

   | makeresults 
    | eval data=strftime(strptime("8/29/2018 6:00:00 AM","%m/%d/%Y %H"),"%H")
    | eval calc=if(data=04,1,0)
    | table data calc
0 Karma

nmohammed
Contributor

JobName Cron Schedule
JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @nmohammed,

Did the below answer answer your question? If so, please resolve this post by approving the answer below. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!