Alerting

How to set a query to run from Monday to sunday

Kwip
Contributor

Hi All,
I wan to run a query on every Monday morning 6AM. For this run I want set the days span as from Last Monday to Sunday. Say example,
If I am running the query on 11/06/2017 morning 6 AM, I want my query to run staring from 10/30/2017 to 11/05/2017.

As W0 is stands for Sunday and W1 is stands for Monday, I could not able to set W1 to earliest and W0 to latest.

Is there any other ways do this. Any kind help is much appreciated.

0 Karma
1 Solution

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

View solution in original post

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

Kwip
Contributor

This one also working fine. Thank a lot for your response!

0 Karma

mayurr98
Super Champion

hey @Kwip you are welcome,
You can accept my answer as well if you think the answer is relevant to your question.

0 Karma

Kwip
Contributor

I am having one more query. how to set the alert to run from 26 of last month to 25 of current month. Say example,
Every month day 1 I will run monthly report, for the run on December month the period should be 26th of October to 25th of November.

Please guide on the same.

0 Karma

skalliger
Motivator

Where is the problem? You simply save it as a scheduled alert with a Cron Expression as the following:

0 0 * * 1

the first "0" is the minute, the second "0" is the hour where it will be ran. The last 1 represents the first day of the week, monday.

Then, you simply write in the alert earliest: -7d@d, latest: -1d@d.

Did that answer your question?

Skalli

Kwip
Contributor

My Bad.. Really forget to think in this perspective.

Thanks a lot for your prompt response!!!

0 Karma

skalliger
Motivator

You're welcome. 🙂

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...