How to write a cron schedule to run Splunk alerts biweekly on Mondays?

[prakashbhanu407]

I have a requirement to Trigger Splunk Alerts Bi-Weekly Mondays (Not 1st and 3rd OR 2nd and 4th weeks)
and if a month has 5 Mondays...it could be 1st, 3rd, and 5th Mondays.

I can't think of a cron expression to meet this requirement,

Thanks in advance.

[woodcock]

It is IMPOSSIBLE to have the search (not) run the way that you describe. However, what IS possible is to have it CRASH (and not complete) when it should not be running. Just set up the condition to trigger for Number of Results Greater Than 0 and schedule it to run every Monday ( * * * * 1 ). The only some Mondays part operates from INSIDE the search and will cause the search to CRASH (and therefore be IMPOSSIBLE to alert) during the blackout period. In this case, the logic to do that is this: figure out which Monday it is and then if that number is not 1, 3, or 5, set Bogus values for earliest and latest that will cause the search to crash. Otherwise, just copy the correct values from addinfo and pass them along as-is. This is your search:

Your Base Search Here

[| makeresults | addinfo
| eval date_mday=strftime(now(), "%d")
| eval date_wday_which = ceil(tonumber(strftime(now(), "%d"))/7)
| eval earliest=if(match(date_wday_which, "[135]"), info_min_time, "ThisSearchOnlyRunsOnOddWeeks")
| eval latest  =if(match(date_wday_which, "[135]"), info_max_time, "ItDeliberatelyCrashesOnEvenWeeks")
| fields earliest latest
| format "" "" "" "" "" ""
| fields search
| rex field=search mode=sed "s/\"//g"]

| The Rest Of Your Search Here

So in the good (1/3/5) case, it will look like this:

    Your Base Search Here earliest=1476225660 latest=1476229310 | The Rest Of Your Search Here

But in the bad (2/4) case, it will come out like this:

    Your Base Search Here earliest=ThisSearchOnlyRunsOnOddWeeks latest=ItDeliberatelyCrashesOnEvenWeeks | The Rest Of Your Search Here

[prakashbhanu407]

Sorry for any confusion but My requirement is to Run the alert on Alternate Mondays irrespective of the month
so if we setup the Alert to run for the first time on 1st week then it has to run on all Odd weeks
if it starts on 2nd week , it has to run on all even weeks.

Is there a function to get the Count of the week in an year ?