Is it possible to configure more than 1 cron for one alert?

[praddasg]

Is it possible to configure more than 1 cron for one alert? some thing like */2 9-11,11-13 * * 1-4,5-1, i think the answer is no but wanted reconfirm. The reason i want to know is because alert condition is same but the triggering times will differ based upon day and hours

[woodcock]

You can use my unaccepted answer here to do what you need. Please do UpVote my answer because it is better than the accepted answer, which is wrong and says that it cannot be done (it can):
https://answers.splunk.com/answers/172541/is-it-possible-to-purposely-cause-a-scheduled-sear.html

[gcusello · Accepted solution]

hi @praddasg,
let me understand: you want to run your alert:

• every two minutes,
• from Sunday to Wednesday from 9.00 to 11.00
• from Thursday to Saturday from 11.00 to 13.00

is it correct?

Anyway, you cannot configure two crons, you have two workarounds:

• create two alerts, with its own cron,
• manage the condition in the search (using date_wday and date_hour fields).

Ciao.
Giuseppe

[praddasg]

Hello @gcusello
Can you help me with the syntax if i want to use date_wday and date_hour

[gcusello]

hi @praddasg,
try a condition like this:

index=_internal (((date_wday=sunday OR date_wday="monday" OR date_wday="thursday" OR date_wday="wednesday") (date_hour>8 date_hour<12)) OR ((date_wday="tuesday" OR date_wday="friday" OR date_wday="saturday") (date_hour>10 date_hour<14)))

Then you can schedule your alert every two minutes.

Ciao.
Giuseppe

[praddasg]

Hello @gcusello Thank you. I think i can use this