how to schedule an alert every Sunday at 5am on Splunk? I am trying to set alert using cron schedule and wasn't successful. I have tried cron schedule queries but no chance. Can you please help me with this?
runt the saerch and save as alert,
apply cron schedule on the alert -> dropdown -> run on cron scedule
place cron and save
I like to use cron calculator here:
https://crontab.guru/
check this out:
https://crontab.guru/#0_5_*_*_7
this is the config: 0 5 * * 7
runt the saerch and save as alert,
apply cron schedule on the alert -> dropdown -> run on cron scedule
place cron and save
I like to use cron calculator here:
https://crontab.guru/
check this out:
https://crontab.guru/#0_5_*_*_7
this is the config: 0 5 * * 7
Adonio Thank you for your answer. The problem is i am trying to change the existing alerts schedule. When i put the cron schedule it gives me this error:
Encountered the following error while trying to update: In handler 'savedsearch': Invalid cron_schedule="0 5 * * 7"
my bad, didnt wrap it in text look at the link above the cron is 0 5 * * 7
try the calculator
Hi,
@mvonal, This answer is wrong.
In fact, if you go to https://crontab.guru/#0_5_*_*_7, it says "Non standard! May not work with every cron."
From the Splunk documentation:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/CronExpressions
Your cron schedule for sunday, has to be like this: 0 5 * * 0
if you put a 7 on the day, splunk will go crazy, and it will repeat the alert in an infinite loop. I tell you this because I have just had this exact same problem. Sunday is 0 on the cron schedule