How do you create an alert for different cron schedules?

[nmohammed]

We have 4 tasks that run on different schedules and log an event in the application logs when the job starts. The task is to alert if the job doesn't run on a prescribed schedule. Can this be done with a single search command ?

JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

Event produced in Log -

[2018-08-29 06:00:00,912] {Worker #04283bd8} INFO JobA::Execute - ********************** Job Name : AgedApplicationNotificationJob - started at : 8/29/2018 6:00:00 AM **********************

Thanks

[Shan]

@nmohammed,

Yes you can achieve it. If you have Started at as a separate field then by extracting the Hours separately and compare with epoc time. Else you need to write a regex to extract Started at filed and achieve it .

Example: If this job need to start at 4 am but it started at 6 am. lets see how we can check it and trigger a alert.
started at : 8/29/2018 6:00:00 AM. You can write an alert.

   | makeresults 
    | eval data=strftime(strptime("8/29/2018 6:00:00 AM","%m/%d/%Y %H"),"%H")
    | eval calc=if(data=04,1,0)
    | table data calc

[nmohammed]

JobName Cron Schedule
JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

[mstjohn_splunk]

Hi @nmohammed,

Did the below answer answer your question? If so, please resolve this post by approving the answer below. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂