Reporting

Monthly Saved Search For Previous Month

peasead
Path Finder

I'd like to create a saved search that run monthly for the previous month. I know how to do that in the Search app, but when creating a saved search, I don't see those options.

I am going to try and schedule cron 0 0 1 * * and fill the Start Time with "-1mon@mon" and the End Time with "@mon".

Is that going to work?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it

10 0 1 * *

So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.

The start and end time look correct.

View solution in original post

lguinn2
Legend

Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it

10 0 1 * *

So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.

The start and end time look correct.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...