How to develop a cron schedule from Sunday 10pm to Saturday 5am every 15 mins?

[splunkuserjpmc]

Hello,

I need help on writing cron schedule in Splunk from Sunday 10pm to Saturday 5am every 15 mins.

I have tried below options, but its not working:
/15 22,23,0-5 6-0 : but 6-0 is not allowing on Splunk
/15 22,23,0-5 sun,sat : but this will run on sat 10pm to Sunday 5 am and again Sunday 10pm to Monday 5am.
/15 22,23,0-5 * sun-sat : but sun-sat is not allowing on Splunk.

It is mentioned in the Splunk documentation that "Splunk's cron implementation does not currently support names of months/days. "

Please help.

[somesoni2]

This can't get handling via one cron. You would either need to split it into multiple cron (see answer from @maciep) OR use this workaround for single cron.

Cron:- */15 * * * 0-6
Start: -15m@m , End - @m

Add following to your base search

your base search [| gentimes start=-1 | eval hour=strftime(now(),"%H") | eval day=lower(strftime(now(),"%A")) | eval index=if((day="sunday" AND hour<22) OR (day="saturday" AND hour>=5),"YouWillNotFindThisIndex","*") | table index ] | rest of the search

[maciep]

I am not a cron expert, but you might have to break that up into multiple cron schedules, e.g. sunday 22-23:45 (/15 22,23 * * 0), monday 12am through Friday 23:45 (/15 * * * 1,2,3,4,5) , Saturday 00-05 (*/15 0,1,2,3,4,5 * * 6)

[splunkuserjpmc]

@maciep : Thanks for your response, but our requirement is to schedule this as one alert. If we break it up into 3 schedules we may result in creating 3 alerts. Do we have any possibility in Splunk to do it as part of same alert or can we give multiple schedules for single alert?