@rzv424  Solution1: You can create two alerts with the same logic with different CRONs. 1st alert CRON will run every day except on Wed and Fri. Cron is: */30 * * * 0,1,2,4,6 Second alert CRON will run every 30 minutes on Wednesday and Friday and will stop from 5AM to 8AM. Cron is: */30 0-5,8-23 * * 3,5 Solution2: You can create one alert with a CRON to run every day of the week at 30 minutes interval, Cron is */30 * * * * And you can add the filtering at the logic of query itself: Use an EVAL command to output the current day and hour after your logic ends. and then filter or don't show your outputs as per your exception requirement ......| eval now_day=strftime(now(), "%a"), now_hour=strftime(now(), "%H") | search NOT ((now_day="Wed" AND (now_hour="5" OR now_hour="6" OR now_hour="7" OR now_hour="8")) OR (now_day="Fri" AND (now_hour="5" OR now_hour="6" OR now_hour="7" OR now_hour="8"))) ... View more