Use cron expressions for alert scheduling
You can customize alert scheduling using a time range and cron expression. In Splunk Cloud Platform, the timezone is always Coordinated Universal Time (UTC). In Splunk Enterprise, the cron analyzer defaults to the timezone where the search head is configured. This can be verified or changed by going to Settings > Searches, reports, and alerts > Scheduled time.
Cron expression syntax
A cron expression is a data string of five fields separated by spaces.
From left to right, the five cron fields have the following chronological value ranges:
- Minute: 0-59
- Hour: 0-23
- Day of the month: 1-31
- Month: 1-12
- Day of the week: 0-6 (where 0 = Sunday)
Commonly used cron field formats
The following cron field formats suit most use cases.
Format | Description | Explanation of description | Hour field example | Example meaning |
---|---|---|---|---|
N
|
One value | Only this value | 9
|
9:00 AM |
N,M
|
Multiple comma-separated values | Only the listed values | 9,15
|
9:00 AM and 3:00 PM |
I-J
|
Value range, inclusive | All values in this range, including the range start and end values | 9-17
|
9:00 AM through 5:00 PM |
*
|
Asterisk (indicates "all values") | Each value in this field | *
|
Every hour |
*/N
|
Every N value in this field | All values in this field are intervals of N | */3
|
Every 3 hours0, 3, 6, 9, 12, 15, 18, 21 |
Cron field formats for ranges and intervals
In some cases, you might want to use multiple value ranges or combine ranges and an interval in a cron expression. The following format options are available.
Format | Description | Meaning | Hour field example | Example meaning |
---|---|---|---|---|
I-J,K-L |
Multiple comma-separated value ranges | All values in each of these ranges, including the range start and end values. | For example: 9-12,15-17Would look like * 9-12,15-17 * * *
|
An alert would run at every minute from 9:00 AM through 12:00 PM and 3:00 PM through 5:00 PM. |
I-J/N |
Range and /N interval
|
Each value in this field that is an interval of /N and is within this range
|
For example: N=2 9-12/2 This would look like * 9-12/2 * * *
|
An alert would be sent every minute past every 2nd hour from 9:00 AM through 12:00 PM |
I-J/N,K-L/N |
Multiple comma-separated ranges and /N interval
|
Each value in this field that is an interval of /N and is within the specified ranges
|
For example: N = 1 9-12/1,15-17/1 This would look like * 9-12/1,15-17/1 * * *
|
An alert would run every minute of every hour from 9:00 AM through 12:00 PM and every minute of every hour from 3:00 PM through 5:00 PM. |
Working with cron intervals
In cron expressions with an interval of /N
, all values in the specified range that are intervals of N
are used. If a number in the range is outside of the interval N
, the value resets to 0.
For example, */9 * * * *
means "every nine minutes" starting with minute 0 within an hour. The following minute field values are used:
9, 18, 27, 36, 45, 54
After 54
, the value resets to 0
.
This syntax isn't compatible with every system
Cron value ranges and intervals
When using a I-J/N
range and interval format, the interval N
is applied to the first number in the range.
For example, 13-36/10
in the minute field results in the following values used:
13, 23, 33
Example expressions
Here are some example cron expressions.
5 9 * * * At 9:05 every day. 30 * * * * At minute 30 of every hour. For example, if you set this CRON job at 11:02, your job will begin running at 11:30, 12:30, 1:30, etc... * 1 * * * Every minute of hour 1. For example: 1:01, 1:02,...,1:59. 0 12 * * * At 12 PM every day, on the hour. */20 * * * 1-5 At every 20 minutes of every hour, beginning at minute zero, Monday through Friday. For example: 11:20, 11:40, 12:00... 0 9 1-7 * * The first 7 days of every month at 9 AM.
Create scheduled alerts | Alert scheduling tips |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release), 9.2.2406
Feedback submitted, thanks!