Alerting

How do I schedule a cron job to run every 6 hours, which should start at a particular time?

varad_joshi
Communicator

I need to start a cron job where I am setting up alerts every 6 hours using * */6 * * * in cron. However I want first alert to get triggered at a particular time. where do I set that?

This could be fairly simple, a newbie here 🙂

Tags (3)
0 Karma
1 Solution

FritzWittwer_ol
Contributor

or you can just use commas:

57 1,7,13,19 * * *

Means on the 57th Minute of the hours 1, 7, 13 and 19

View solution in original post

FritzWittwer_ol
Contributor

or you can just use commas:

57 1,7,13,19 * * *

Means on the 57th Minute of the hours 1, 7, 13 and 19

varad_joshi
Communicator

Like I said it could be fairly simple. One of the colleague @meenal901 also suggested.
Thanks this was helpful.

0 Karma

lloydd518
Path Finder

I don't think cron can quite meet your requirement but I have produced a couple of examples where we can try and manipulate cron which may help you solve your problem..

57 7-23/6 * * *

This schedule runs on the 57th minute of the the hour - between 7am and 11pm every 6 hours... So in splunk it fires at 7:57 13:57 19:57 And back to 7:57 the next day...

00 1-23/6 * * *
This schedule runs at the start of the hour 00min between 1am and 11pm every 6 hours.... So in splunk it fires at 01:00 07:00 13:00 19:00 And back to 01:00 the next day...

00 5-24/6 * * *
This schedule runs at the start of the hour 00min between 5am and 12am every 6 hours.... So in splunk it fires at 05:00 11:00 17:00 23:00 And back to 05:00 the next day...

So this may help you but it can end up missing a period as in the first example which only fired 3 times as opposed to the next 2 examples which fired off 4 times...

Hope this helps...

lloydd518

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...