Hello I want to run a search/alert that is run in a certain timespan (for example between 18:00 and 08:00) and then sends a alert.
You can find instructions for setting up search and alerting here:
http://www.splunk.com/base/Documentation/latest/user/SchedulingSavedSearches#Start_by_defining_and_s...
You'd use a custom schedule with a cron job like syntax. I believe the following should work, it wouldn't hurt to double check:
Hmm, i mean that i want to have a search that is ran every hour (for example, can be every half an hour aswell) between 18 and 08:00, and sending an alert if its true.
sorry this is not clear for me what timespan you want? is it the search result timespan? or the schedule when the search/alert is run?
