Splunk Search

Cron expression for first two mondays of every month

ASISH_9
Engager

I need a cron expression that would run a report on first two mondays of every month.What would be the expression?Thanks in advance

Tags (1)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Not sure how flexible the cron syntax is within Splunk so mabe you could try with:

0 8 1-14 * 1

Which reads as: At 08:00 on every day-of-month from 1 through 14 that is also a Monday.

ASISH_9
Engager

Thanks Javiergn but it's not the requirement I want.Canwe make any changes at the last number ie 1 which shows Monday?

0 Karma

javiergn
SplunkTrust
SplunkTrust

What's your actual requirement?
You can make any changes you like, syntax is as follows:

*    *    *    *   *
-     -     -     -    -
|    |    |    |   |
|    |    |    |   +----- day of week (0 - 6) (Sunday=0)
|    |    |    +------- month (1 - 12)
|    |    +--------- day of month (1 - 31)
|    +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Karma

ASISH_9
Engager

You might be correct.I took 1-14 as dates not as day.Thanks.And sorry also my mistake

0 Karma

javiergn
SplunkTrust
SplunkTrust

No worries. Please don't forget to confirm the answer once you have verified it fully works for you.
I'm still not 100% sure anymore given what c_krishna_guturi mentioned above so you are going to have to test and let us know.

0 Karma

c_krishna_gutur
Explorer

The expression will give the alerts at 08:00 on every day-of-month from 1 through 14 and on Monday

javiergn
SplunkTrust
SplunkTrust

You might be right. Don't have my lab to test this but I'm finding contradictory answers online:

See for instance:

http://cronexpressiondescriptor.azurewebsites.net/?Language=en-US&DayOfWeekStartIndexOne=false&Use24...

VS

http://corntab.com/?c=0_8_1-14/7_*_1

I don't have my lab to test this at the moment sorry

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...