how to schedule an alert every Sunday at 5am?

[mvonal]

how to schedule an alert every Sunday at 5am on Splunk? I am trying to set alert using cron schedule and wasn't successful. I have tried cron schedule queries but no chance. Can you please help me with this?

[adonio · Accepted solution]

runt the saerch and save as alert,
apply cron schedule on the alert -> dropdown -> run on cron scedule
place cron and save

I like to use cron calculator here:
https://crontab.guru/
check this out:
https://crontab.guru/#0_5_*_*_7

this is the config: 0 5 * * 7

[mvonal]

Adonio Thank you for your answer. The problem is i am trying to change the existing alerts schedule. When i put the cron schedule it gives me this error:

Encountered the following error while trying to update: In handler 'savedsearch': Invalid cron_schedule="0 5 * * 7"

[adonio]

my bad, didnt wrap it in text look at the link above the cron is 0 5 * * 7
try the calculator

[faguilar]

Hi,
@mvonal, This answer is wrong.
In fact, if you go to https://crontab.guru/#0_5_*_*_7, it says "Non standard! May not work with every cron."

From the Splunk documentation:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/CronExpressions

Your cron schedule for sunday, has to be like this: 0 5 * * 0

if you put a 7 on the day, splunk will go crazy, and it will repeat the alert in an infinite loop. I tell you this because I have just had this exact same problem. Sunday is 0 on the cron schedule