×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
lespinoza212
New Member
Member since: ‎04-05-2019
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-05-2019
View All

Re: Splunk Alert With Cron Triggering when it shou...

by in Alerting
‎04-05-2019 08:43 AM
‎04-05-2019 08:43 AM
Hello @renjith.nair , Thanks for the quick response. I've read that part of the crontab manual, but if it is as it says, it would have triggered on Wednesday (04/03) as well, which it didn't. My alert triggers if my search string results count is equal to 0. These logs are only expected on the first monday of every month. I remembered that when I created the alert some months ago, I took as reference this post: https://answers.splunk.com/answers/495212/cron-expression-for-first-two-mondays-of-every-mon.html Luis ... View more

Splunk Alert With Cron Triggering when it shouldn'...

by in Alerting
‎04-05-2019 06:50 AM
‎04-05-2019 06:50 AM
Hello, Recently we got Splunk upgraded to version 7.2.5.1 and one of my alerts have been triggering not following it's cron schedule expression. I wrote this cron expression for an alert which only supposed to run at 8am the first Monday of every month: 0 8 1-7 * 1 Just to break this down: 0: Minute 8: Hour 1 - 7: Day of the month *: Month 1: Day of the week (Monday) The alert was behaving as expected before the upgrade. It have triggered on Tuesday 04/02 at 8pm Est and on Thursday 04/04 at 8pm. What may be the issue? Any help is appreciated. Thanks for your time. Luis Espinoza ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM