Alerting

Cron Issue: How to send a report on specific day?

AlexeySh
Communicator

Hello,
I'd like a report to be sent every first Tuesday of the month at 11:00 pm. Thinking logically, I should use this cron: 0 23 1-7 * 2. But for some reason, I receive the report every day during the first week of the month.
Do you have an idea what am I doing wrong?

Thanks for the help.
Alex.

0 Karma
1 Solution

wenthold
Communicator

The Cron schedule is inclusive, so 1-7 will result in alerts being sent every day for that first week. You can review sample crontab schedules at crontab.guru

What I believe would work is using an Alert with a conditional trigger, then adding some logic to your search based on the current date/time of the results so that Splunk only meets the condition for sending an alert during the time window you want to trigger.

For this example the search you're trying to send would include some kind of aggregate count, using "{base search} | eval count by myfield"

Create a new saved search and set the cron schedule to run every tuesday:

0 23 * * 2

... set the search alert condition to "if custom condition is met" and add the criteria

search count > 0

Then the following at the end of the saved search:

    | eval da_wday=strftime(now(),"%w"), da_mday=strftime(now(),"%d")
    | eval count=case(da_mday<=7 AND da_wday==2,count,1==1,0)
    | fields - da_*

These additional search commands will zero out the "count" field unless the current day/time is in the first week (da_mday<=7) and the weekday is Tuesday (da_wday==2). The search will run every Tuesday thanks to the Cron schedule in the saved search, but your custom alert condition will drop those since the alert condition isn't being met.

View solution in original post

wenthold
Communicator

The Cron schedule is inclusive, so 1-7 will result in alerts being sent every day for that first week. You can review sample crontab schedules at crontab.guru

What I believe would work is using an Alert with a conditional trigger, then adding some logic to your search based on the current date/time of the results so that Splunk only meets the condition for sending an alert during the time window you want to trigger.

For this example the search you're trying to send would include some kind of aggregate count, using "{base search} | eval count by myfield"

Create a new saved search and set the cron schedule to run every tuesday:

0 23 * * 2

... set the search alert condition to "if custom condition is met" and add the criteria

search count > 0

Then the following at the end of the saved search:

    | eval da_wday=strftime(now(),"%w"), da_mday=strftime(now(),"%d")
    | eval count=case(da_mday<=7 AND da_wday==2,count,1==1,0)
    | fields - da_*

These additional search commands will zero out the "count" field unless the current day/time is in the first week (da_mday<=7) and the weekday is Tuesday (da_wday==2). The search will run every Tuesday thanks to the Cron schedule in the saved search, but your custom alert condition will drop those since the alert condition isn't being met.

AlexeySh
Communicator

Hello @wenthold ,

The solution is a bit more complicated that I thought 🙂 But it works perfectly fine.

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...