As richgalloway said, you need 2 separate alerts for 2 separate cron schedules. To make this maintainable, you could make a single Saved Search, then make 2 separate alerts that reference the single ...
See more...
As richgalloway said, you need 2 separate alerts for 2 separate cron schedules. To make this maintainable, you could make a single Saved Search, then make 2 separate alerts that reference the single Saved Search using the | savedsearch (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch) Each alert will have a cron schedule: 1) 4 times a day starting from 12am, 6am, 12pm, 6 pm (weekends - Sat and Sun) 0 */6 * * 0,6 2) only at 6AM on weekdays (Mon-Fri) 0 6 * * 1-5 For formulating cron schedules, I recommend using the website https://crontab.guru/ as it makes a human-readable schedule at the top.