Splunk® Enterprise

Alerting Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF

Create scheduled alerts

Create a scheduled alert to search for events on a regular schedule. You can configure scheduling, trigger conditions, and throttling to customize the alert.

To compare scheduled and real-time alerts, see Alert types. To review scenarios for alert types and triggering, see Alert type and triggering scenarios.

Using cron expressions

You can use a cron expression to customize alert scheduling. See Use cron expressions for scheduling to learn more.

Create a scheduled alert



  1. Navigate to the Search page in the Search and Reporting app.
  2. Create a search.
  3. Select Save As>Alert.
  4. Enter a title and optional description.
  5. Specify permissions.
  6. Configure alert scheduling. There are two options for scheduling.
    Option Next steps for this option
    Select one of the available scheduling options and set a time. None.
    For further customization, select Run on Cron Schedule to use a time range and cron expression.
    1. Enter the Earliest and Latest values for the search time range. These values override the original search time range. To avoid overlaps or gaps, the execution schedule should match the search time range. For example, to run a search every 20 minutes the search time range should also be 20 minutes (-20m).
    2. Enter a cron expression to schedule the search. See cron expression examples here: Use cron expressions for scheduling.
  7. (Optional) Change the Expires setting. This setting controls the lifespan of triggered alert records, which appear on the Triggered Alerts page.
  8. Configure trigger conditions.
  9. (Optional) Configure a trigger throttling period.
  10. Select one or more alert actions that should happen when the alert triggers.
  11. Click Save.

Additional resources

Alert type and triggering scenarios
Use cron expressions for alert scheduling

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2


Hi All,
Can share what is the cron expression for 08:15 AM ?
Anyone can help ?
Thanks & Regards,
Alan Toh

June 24, 2019

HI @Sideview,
Thanks for your comment. I'll follow up with you directly to get more details, as I'm not finding the UI where this link shows up. Our current software version does not seem to include it.

Frobinson splunk, Splunker
February 3, 2017

Docs/Product bug -
On the create/edit alert screen in the product, under the "custom condition search", it says "Custom condition is a conditional search that Splunk applies to the results returned by the scheduled search" and then there's a "read more" link that goes to this page by mistake.

February 2, 2017

HI @Petro chernli,
This is a good suggestion. I"ll add it to the docs.

Frobinson splunk, Splunker
October 5, 2016

I've been puzzled for couple of minutes what's the "day" parameter (third one) and how it's different from fifth parameter. Turns out its "Day(s) of Month"! Let's add it to the description, maybe?

Petro chernii
October 5, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters