Reporting

Saved Search Cron Error?

stevensa
Explorer

Hey Everyone,

Thanks for taking the time to help!

I have a series of saved searches that are supposed to be running every three minutes after 1am Tuesday-Saturday to report for previous day information:

0 1 * * 2-6
3 1 * * 2-6
6 1 * * 2-6
9 1 * * 2-6
etc...

However, these searches are not running on Saturdays. They run fine Tuesday-Friday but then do not run on Saturday. Can anyone point me in the right direction for what I am doing wrong? Really appreciate your help!

Adam

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

You cron seems correct

Can you try to list the days 0 1 * * 2,3,4,5,6

Remark: there is no 6th parameter for year in splunk.

yannK
Splunk Employee
Splunk Employee

I confirm, there is no year in the splnuk cron notation. (I edited my answer)

stevensa
Explorer

Yannk,
Thank you for your response! Splunk does not like the addition of the final star (Currently using 4.1.7, with the 4.2 ugprade expected in a few weeks!). However, I will try explicitly listing the days and report on that Monday.
Thanks again for the suggestion!

Adam

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...