Reporting

How to schedule a report email with a CSV attachment of search results every 4 hours?

Laya123
Communicator

Hi,

Can any one help me on how to schedule a report with an attachment (csv) and email to my boss every 4 hours with last 4 hours of search results? I used cron expression 0 */4 * * *, but it's not generating a report every 4 hours.

Example: Email a report for every 4 hours; first email has to be sent at 4am for the results of last 4 hours (1am - 4am). The second email has to be sent at 8am for the results of 5am to 8am

Please help me to do this

Thanks in advance

0 Karma
1 Solution

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

View solution in original post

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

woodcock
Esteemed Legend

Please "Accept" this answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, 0 */4 * * * will run once every four hours, at zero minutes past 0, 4, 8, 12, 16, 20.

0 Karma

Laya123
Communicator

Hi,

I am bit confused can you tell me

0 */4 * * * - does this cron help to get an email every 4 hours?

Thanks

0 Karma

Laya123
Communicator

Thanks for your immediate response

it means email will go for every 4hours with last 4hours of results right

Thanks

0 Karma

woodcock
Esteemed Legend

The "last 4 hours" part is controlled by the time specifier which should be -4h@h.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...