Splunk Search
Highlighted

How do you create an alert for different cron schedules?

Contributor

We have 4 tasks that run on different schedules and log an event in the application logs when the job starts. The task is to alert if the job doesn't run on a prescribed schedule. Can this be done with a single search command ?

JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

Event produced in Log -

[2018-08-29 06:00:00,912] {Worker #04283bd8} INFO JobA::Execute - ********************** Job Name : AgedApplicationNotificationJob - started at : 8/29/2018 6:00:00 AM **********************

Thanks

0 Karma
Highlighted

Re: How do you create an alert for different cron schedules?

Contributor

JobName Cron Schedule
JobA 0 02 * * *
JobB 0 2/4 * * *
JobC 0 03 * * *
JobD . 0 0/2 * * *

0 Karma
Highlighted

Re: How do you create an alert for different cron schedules?

Splunk Employee
Splunk Employee

Hi @nmohammed,

Did the below answer answer your question? If so, please resolve this post by approving the answer below. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂

0 Karma
Highlighted

Re: How do you create an alert for different cron schedules?

@nmohammed,

Yes you can achieve it. If you have Started at as a separate field then by extracting the Hours separately and compare with epoc time. Else you need to write a regex to extract Started at filed and achieve it .

Example: If this job need to start at 4 am but it started at 6 am. lets see how we can check it and trigger a alert.
started at : 8/29/2018 6:00:00 AM. You can write an alert.

   | makeresults 
    | eval data=strftime(strptime("8/29/2018 6:00:00 AM","%m/%d/%Y %H"),"%H")
    | eval calc=if(data=04,1,0)
    | table data calc
0 Karma