I am trying to find out whether a report or search can run every second tuesday of a month. I have checked the presets and time range doesn't have any option and I am thinking, is it possible by cron schedule? Please share your valuable answers here.
Thanks
I think the answer is that it is not easily possible in crontab on the OS level and I don't think you'll have hence luck with any cron expression within Splunk.
I also think the the solution referenced in the comment above may not work due to crontab's evaluation of day and month specification. It will likely cause the search to run on all listed days AND on Tuesdays, i.e. be a OR vs. an AND evaluation.
Just out of curiosity: What would be the impact if your search runs every Tuesday? If you want to prevent reports being sent out as a result of the search, you may be able to add some SPL magic to your search that determines whether the current day is the second Tuesday of a month and sets a field to true/false. Example (you need to validate this does what it should):
| eval daynumber=strftime(now(),"%d"), weekday=strftime(now(),"%a"), isSecondTuesday=if(weekday=="Tue" AND daynumber>7 AND daynumber<14, "true", "false" )
Wrap it in a macro to not clutter your reporting search and make it reusable. You can then add a custom alert condition, like search isSecondTuesday="true"
to your scheduled report and it will not trigger the alert action (i.e. send the email).
The reason for second tuesday is that ,we do reboots and re run every second tuesday
0 12 8-14 * 3 echo '2nd Wednesday .........does this work
I don't think so. This would run on the 8,9,10,11,12,13,14, AND on Wednesdays, I think
Here is a question that is similar to what you were looking to do.
https://answers.splunk.com/answers/112803/how-to-schedule-search-on-2nd-saturday-of-every-month.html
I am trying to figure it out but bot able to,can you tell how it is done for every second tuesday?