Search/alert that is ran after work hour

[fisk12]

Hello
I want to run a search/alert that is run in a certain timespan (for example between 18:00 and 08:00) and then sends a alert.

[jbsplunk]

You can find instructions for setting up search and alerting here:

http://www.splunk.com/base/Documentation/latest/user/SchedulingSavedSearches#Start_by_defining_and_s...

You'd use a custom schedule with a cron job like syntax. I believe the following should work, it wouldn't hurt to double check:

• 0-8,18-21 * * *

[fisk12]

Hmm, i mean that i want to have a search that is ran every hour (for example, can be every half an hour aswell) between 18 and 08:00, and sending an alert if its true.

[MarioM]

sorry this is not clear for me what timespan you want? is it the search result timespan? or the schedule when the search/alert is run?