Splunk Enterprise Security

How to set up cron to run search out of working hours?

woodentree
Communicator

Hello,

We would like to run a correlation search every 15 minutes but only out of working hours. It means from 6pm to 8am on weekdays and 24 hours on weekends. We thought about the cron below:

14-59/15 18-23,0-7 * * *

However, in this case, we do not cover 8am-6pm scope on weekends, which is not good. Do you have an idea which cron we should use?

Thanks for the help.

0 Karma
1 Solution

nickhills
Ultra Champion

One option is schedule two searches - one for weekdays, and one for weekends.
14-59/15 18-23,0-7 * * 1-5 for weekdays
and
14-59/15 * * * 6-7 for weekends

If my comment helps, please give it a thumbs up!

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @woodentree,
the easiest way is to use a cron every 15 minutes ( */15 * * * * ) and manage the exclusions in the search adding to the main search:

(NOT (date_wday=Sunday OR date_wday=Saturday) date_hour>17 date_hour<8)

but in this way you don't manage the holydays.

To manage holydays, you have to create a calendar lookup and use it for the exclusions.

Ciao.
Giuseppe

woodentree
Communicator

Hi @gcusello,

Thanks for the help.

I’m afraid it will not work for us. Most of our correlation searches uses tstats with avg , sum or count functions.

0 Karma

nickhills
Ultra Champion

One option is schedule two searches - one for weekdays, and one for weekends.
14-59/15 18-23,0-7 * * 1-5 for weekdays
and
14-59/15 * * * 6-7 for weekends

If my comment helps, please give it a thumbs up!

woodentree
Communicator

Hi @nickhillscpl ,

Appreciate your help.

It could be a workaround but I’m afraid not the best one for our circumstances. It will add an additional complexity to maintain a third party inventory tool we have to list our searches in, to set up reporting for management, etc.). Do you know if there is a way to do it in one search?

Thanks.

0 Karma

nickhills
Ultra Champion

In that case, use the solution below from @gcusello !

If my comment helps, please give it a thumbs up!
0 Karma

woodentree
Communicator

Like I've just answered to @gcusello, it looks like it will not be possible for our searches 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...