Cron expression for first two mondays of every month

[ASISH_9]

I need a cron expression that would run a report on first two mondays of every month.What would be the expression?Thanks in advance

[javiergn]

Not sure how flexible the cron syntax is within Splunk so mabe you could try with:

0 8 1-14 * 1

Which reads as: At 08:00 on every day-of-month from 1 through 14 that is also a Monday.

[ASISH_9]

Thanks Javiergn but it's not the requirement I want.Canwe make any changes at the last number ie 1 which shows Monday?

[javiergn]

What's your actual requirement?
You can make any changes you like, syntax is as follows:

*    *    *    *   *
-     -     -     -    -
|    |    |    |   |
|    |    |    |   +----- day of week (0 - 6) (Sunday=0)
|    |    |    +------- month (1 - 12)
|    |    +--------- day of month (1 - 31)
|    +----------- hour (0 - 23)
+------------- min (0 - 59)

[ASISH_9]

You might be correct.I took 1-14 as dates not as day.Thanks.And sorry also my mistake

[javiergn]

No worries. Please don't forget to confirm the answer once you have verified it fully works for you.
I'm still not 100% sure anymore given what c_krishna_guturi mentioned above so you are going to have to test and let us know.

[c_krishna_gutur]

The expression will give the alerts at 08:00 on every day-of-month from 1 through 14 and on Monday

[javiergn]

You might be right. Don't have my lab to test this but I'm finding contradictory answers online:

See for instance:

http://cronexpressiondescriptor.azurewebsites.net/?Language=en-US&DayOfWeekStartIndexOne=false&Use24...

VS

http://corntab.com/?c=0_8_1-14/7_*_1

I don't have my lab to test this at the moment sorry