diff --git a/docs/source/splunk/splunk.rst b/docs/source/splunk/splunk.rst index 6b0e780..4a5b96a 100644 --- a/docs/source/splunk/splunk.rst +++ b/docs/source/splunk/splunk.rst @@ -90,6 +90,7 @@ To get search results of Splunk to AWS S3. Follow the steps below: :alt: Configure action for alert :align: center + .. note:: To make a quick test of the alert setup, select ``Run on Cron Schedule`` an type in the cron job schedule with reference to UTC-0 timezone. For example, if the current time is 13:46 UTC-0, then the ``Cron Expression`` can be set to 2 minutes past the current time. ``48 * * * *``. This cron expression will run the alert at every 48th minute past the hour every hour in referene to UTC-0. If this is a one-off test, make sure to use dummy bucket and path to save the output, and make sure to disable the alert once test is successful.