Run Alert Every Few Hours Between Specific Hours/Days

[SplunkLunk]

I have some events that only happen every few hours between the hours of 8AM and 6PM, M-F. So, I want to set up a loss of feeds alert to look for events every three hours between the hours of 8AM and 6PM, M-F. Right now I have the alert to look for "-3h" through "now" and to run every 60 minutes starting at 11 AM and running through 9 PM, M-F via the cron expression "*/60 11-19 * * 1-5"

My rationale is it's starts at 11 AM which will go back three hours to hit the 8AM and end at 9PM to hit the 6 PM cutoff. 60 is the max number of minutes I can put in the cron expression. Is there a way to look every three hours, but only between 8-16 without modifying the actual search (just using cron in the alert config)?

Thanks for any advice.

[richgalloway · Accepted solution]

Try 0 8-16/3 * * 1-5.
I've found crontab.guru is a great site for trying out cron expressions.

[SplunkLunk]

Thanks. I'll give that a shot. I may have to tweak the range, but this appears to work (I can save it in Splunk anyway without errors).