How to schedule a search one day a week

[cneberg]

How do I schedule splunk cron search to run Sunday's at 11:00 pm?

I thought it would be this

00 23 ? * 0

But splunk doesn't appear to support the ? character, which wikipedia says means don't specify the day of the month. I could use an asterisks but I'm guessing that means every day of the month.

[yannK]

try 0 23 * * 0

the 5th part is for the day of the week (0=sunday)

keep the third with a * it will be controlled by the condition on the day of week.

* * * * * command to be executed

---

| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)