cron notation for Bi-Weekly schedule alert in Splunk

[rsathish47]

Hi All,

Cron notation for Bi-Weekly schedule alert in Splunk ?

 * * */2 * * === Is this works?

Thanks
Sathish R

[MuS · Accepted solution]

Hi rsathish47,

No, because the third * does not represent week.

The following cron parameters:

* * * * *

correspond to:

minute hour day month day-of-week

This is un-tested, but I think something like this could work:

00 06 1-7,15-21 * 1

This would run every second week on Monday at 06:00 am.

Hope this helps...

cheers, MuS

[nivedita_viswan]

That does not make it Bi-weekly, does it?
Since we have specified 1-7, 15-21 as the days, consecutive reports may have a gap of 3 weeks.
Take the month of November 2015. The report will run on
2nd Nov, 16th November (2 weeks between 2nd Nov and 16th Nov) and then only on 7th December (3 weeks between 16th Nov and 7th Dec)

[MuS]

Well, this is a generic example and does not cover all month. You have to adjust it to your needs, if it really has to be every second week, because the interval will change over the months and this would end up in some if-then crontab which will be not easy to manage.

For example one for January 2016:

 * 06 1-7,15-21,29-31 1 0

But for February 2016 only run it like this, if it was last run in January on the 30th:

* 06 12-19 2 0

otherwise run it like this (based on January / February 2014 combination):

* 06 1-7,15-21 2 0

Good luck in keeping this clean and I'm sure if you search hard enough there are even more confusing combinations possible.

Make it easy, simple and straight forward; run it forthrightly

* 06 1,15 * *

Yes, I know this will also not provide a precise 2 weeks interval!

[rsathish47]

Thank you Mus, I will try