Use cron expressions for alert scheduling

You can customize alert scheduling using a time range and cron expression. In Splunk Cloud Platform, the timezone is always Coordinated Universal Time (UTC). In Splunk Enterprise, the cron analyzer defaults to the timezone where the search head is configured. This can be verified or changed by going to Settings > Searches, reports, and alerts > Scheduled time.

Cron expression syntax

A cron expression is a data string of five fields separated by spaces.

From left to right, the five cron fields have the following chronological value ranges:

• Minute: 0-59
• Hour: 0-23
• Day of the month: 1-31
• Month: 1-12
• Day of the week: 0-6 (where 0 = Sunday)

Commonly used cron field formats

The following cron field formats suit most use cases.

Format	Description	Explanation of description	Hour field example	Example meaning
N	One value	Only this value	9	9:00 AM
N,M	Multiple comma-separated values	Only the listed values	9,15	9:00 AM and 3:00 PM
I-J	Value range, inclusive	All values in this range, including the range start and end values	9-17	9:00 AM through 5:00 PM
*	Asterisk (indicates "all values")	Each value in this field	*	Every hour
*/N	Every N value in this field	All values in this field are intervals of N	*/3	Every 3 hours 0, 3, 6, 9, 12, 15, 18, 21

Cron field formats for ranges and intervals

In some cases, you might want to use multiple value ranges or combine ranges and an interval in a cron expression. The following format options are available.

Format	Description	Meaning	Hour field example	Example meaning
I-J,K-L	Multiple comma-separated value ranges	All values in each of these ranges, including the range start and end values.	For example: 9-12,15-17 Would look like * 9-12,15-17 * * *	An alert would run at every minute from 9:00 AM through 12:00 PM and 3:00 PM through 5:00 PM.
I-J/N	Range and /N interval	Each value in this field that is an interval of /N and is within this range	For example: N=2 9-12/2 This would look like * 9-12/2 * * *	An alert would be sent every minute past every 2nd hour from 9:00 AM through 12:00 PM
I-J/N,K-L/N	Multiple comma-separated ranges and /N interval	Each value in this field that is an interval of /N and is within the specified ranges	For example: N = 1 9-12/1,15-17/1 This would look like * 9-12/1,15-17/1 * * *	An alert would run every minute of every hour from 9:00 AM through 12:00 PM and every minute of every hour from 3:00 PM through 5:00 PM.

Working with cron intervals

In cron expressions with an interval of /N, all values in the specified range that are intervals of N are used. If a number in the range is outside of the interval N, the value resets to 0.

For example, */9 * * * * means "every nine minutes" starting with minute 0 within an hour. The following minute field values are used:

9, 18, 27, 36, 45, 54

After 54, the value resets to 0.

This syntax isn't compatible with every system

Cron value ranges and intervals
When using a I-J/N range and interval format, the interval N is applied to the first number in the range.

For example, 13-36/10 in the minute field results in the following values used:

13, 23, 33

Example expressions

Here are some example cron expressions.

5 9 * * *        At 9:05 every day.
30 * * * *       At minute 30 of every hour. For example, if you set this CRON job at 11:02, your job will begin running at 11:30, 
                     12:30, 1:30, etc...
* 1 * * *          Every minute of hour 1. For example: 1:01, 1:02,...,1:59.
0 12 * * *       At 12 PM every day, on the hour. 
*/20 * * * 1-5    At every 20 minutes of every hour, beginning at minute zero, Monday through Friday. For example: 11:20, 11:40, 12:00...
0 9 1-7 * *     The first 7 days of every month at 9 AM.