Splunk® Enterprise

Alerting Manual

Download manual as PDF

Download topic as PDF

Use cron expressions for scheduling

Customize alert scheduling using a time range and cron expression.

Cron expression syntax

A cron expression comprises five fields separated by spaces.

From left to right, the five cron fields have the following chronological value ranges.

  • Minute(s): 0–59.
  • Hour(s): 0–23.
  • Day(s) of month: 1–31.
  • Month(s): 1–12.
  • Day(s) of week: 0–6 (where 0 = Sunday).

Commonly used cron field formats

The following cron field formats suit most use cases.

Format Description Meaning Hour field example Example meaning
N One value Only this value 9 9:00 A.M.
N,M Multiple comma-separated values Only the listed values 9,15 9:00 A.M.
3:00 P.M.
I–J Value range, inclusive All values in this range, including the range start and end values 9-17 9:00 A.M. through 5:00 P.M.
* Asterisk (indicates "all values") Each value in this field * Every hour
*/N Every N values in this field All values in this filed are intervals of N. */3 Every 3 hours
 0, 3, 6, 9, 12, 15, 18, 21 

Additional cron field formats for ranges and intervals

In some cases, you might want to use multiple value ranges or combine ranges and an interval in a cron expression. The following format options are available.

Format Description Meaning Hour field example Example meaning
Multiple comma-separated value ranges All values in each of these ranges, including the range start and end values
9:00 A.M. through 12:00 P.M.

3:00 P.M. through 5:00 P.M.
Range and /N interval Each value in this field that is an interval of /N and is within this range
9:00 A.M.
11:00 A.M.
Multiple comma-separated ranges and /N interval Each value in this field that is an interval of /N and is within the specified ranges
9:00 A.M.
11:00 P.M.
3:00 P.M.
5:00 P.M.

Working with cron intervals

In cron expressions with /N interval, all values in the specified range that are intervals of N are used. If a number in the range is outside of the interval N, the value resets to 0.

For example, */9 * * * * means "every nine minutes." The following minutes field values are used.

0, 9, 18, 27, 36, 45, 54

After 54, the value resets to 0.

Cron value ranges and intervals
When using a I–J/N range and interval format, the interval N is applied to the first number in the range.

For example, 13-36/10 in the minutes field results in the following values used.

13, 23, 33

Example expressions

Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20  * * * 1-5   Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9am.
Create scheduled alerts
Alert scheduling tips

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 7.0.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters