{"id":28327,"date":"2021-01-07T14:22:24","date_gmt":"2021-01-07T14:22:24","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=28327"},"modified":"2021-01-07T14:22:24","modified_gmt":"2021-01-07T14:22:24","slug":"answer-by-warren-for-splunk-schedule-alert-to-run-every-10-minutes","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=28327","title":{"rendered":"Answer by warren for Splunk: Schedule alert to run every 10 minutes"},"content":{"rendered":"
\n

Now I want to schedule the alert search to run every 10 minutes. Therefore, I want to run it on cron schedule and chose *\/10 * * * *<\/code>. Is that correct?<\/p>\n<\/blockquote>\n

No, that will run it every 6 minutes: you’re dividing the hour (60 minutes) by 10, giving you a schedule of every 6 minutes<\/p>\n

\n

Secondyl I can chosse an expiration date and a Time Range in the Save as Alert-menu. By default it seems to be set to the last 24 hours (Time Range) and Expiration date as well to the last 24 hours. I am now wondering, if these settings do have an effect on the alert search.<\/p>\n<\/blockquote>\n

That’s how long the results of the given search<\/em> are saved before expiring them<\/p>\n

The time period over which the search runs is set in the search itself. I usually explicitly<\/em> set the period with earliest=<\/code> thusly:<\/p>\n

index=ndx sourcetype=srctp fieldA=* fieldb=* earliest=-10m\n<\/code><\/pre>\n
\n
I also do not want the alert to expire after 24 hours but let the alert search run until it is stopped by me or someone else.<\/p>\n<\/blockquote>\n
I think you misunderstand many Splunk terms. A search will run until it finishes. The results<\/em> of a search are only kept for however-long the expiration time is set for that search (defaults include 10 minutes, 7 days, 24 hours, and 2x the run interval (eg for scheduled Reports)).<\/p>\n
If you schedule an Alert, it will stay scheduled until you (or someone else with appropriate permissions) disable it – I’ve got Alerts that run every 30 minutes that have been in place for months<\/em>. I’ve got others that used to run every hour, but are now disabled (but not deleted, because we need them around during some parts of the year).<\/p>\n
from User warren – Stack Overflow https:\/\/stackoverflow.com\/questions\/65613101\/splunk-schedule-alert-to-run-every-10-minutes\/65614130#65614130
\nvia IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Now I want to schedule the alert search to run every 10 minutes. Therefore, I want to run it on cron schedule and chose *\/10 * * * *. Is that correct? No, that will run it every 6 minutes: you’re dividing the hour (60 minutes) by 10, giving you a schedule of every 6 …
Continue reading Answer by warren for Splunk: Schedule alert to run every 10 minutes<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-28327","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/28327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=28327"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/28327\/revisions"}],"predecessor-version":[{"id":28328,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/28327\/revisions\/28328"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28327"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=28327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}