Reporting

How to schedule a report email with a CSV attachment of search results every 4 hours?

Laya123
Communicator

Hi,

Can any one help me on how to schedule a report with an attachment (csv) and email to my boss every 4 hours with last 4 hours of search results? I used cron expression 0 */4 * * *, but it's not generating a report every 4 hours.

Example: Email a report for every 4 hours; first email has to be sent at 4am for the results of last 4 hours (1am - 4am). The second email has to be sent at 8am for the results of 5am to 8am

Please help me to do this

Thanks in advance

0 Karma
1 Solution

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

View solution in original post

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

woodcock
Esteemed Legend

Please "Accept" this answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, 0 */4 * * * will run once every four hours, at zero minutes past 0, 4, 8, 12, 16, 20.

0 Karma

Laya123
Communicator

Hi,

I am bit confused can you tell me

0 */4 * * * - does this cron help to get an email every 4 hours?

Thanks

0 Karma

Laya123
Communicator

Thanks for your immediate response

it means email will go for every 4hours with last 4hours of results right

Thanks

0 Karma

woodcock
Esteemed Legend

The "last 4 hours" part is controlled by the time specifier which should be -4h@h.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...