Splunk alert schedule

Question

I have created a couple of alerts. The first one is running every 30 minutes from Mon-Friday, and another one is running at 00.00 to 06.00 every 2 hours. What I want is for the 30-minute job to pause or stop while the 2-hour one is running, then have the 30-minute job resume after the 2-hour one is complete. Or, is there another way to put the 30-minute job on hold? Here is the schedule I used for 30M: - 0,30 0-6,12-23 * * 1-5 And this one for 2H: 120M - 0 2-6/2 * * * But I still I see some alerts were triggered during 120 minutes. Kindly help

If not I need to avoid the overlap of last 30 mints of 30 mints job in 2 hours..

Answer 1

Sometimes we have to break a single job into separate alerts to avoid overlapping. To avoid the overlap, schedule the same alert twice using different cron schedules

For 120M:

1. 0 2-6/2 * * * (runs at 00:00, 2:00, 4:00, 6:00 everyday)

For 30M:

1. 30 6 * * 1-5 (runs at 6:30 on a weekday)
2. 0,30 7-23 * * 1-5 (runs at 7:00, 7:30,.....,23:30 on a weekday)