<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Schedule cron job for base report in Other Usage</title>
    <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645524#M604</link>
    <description>&lt;P&gt;Try this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;*/5 0-2,9-11,21-23 * * *&lt;/LI-CODE&gt;&lt;P&gt;Note that is has to be a separate cron schedule or you adapt your report to check whether the search time fits in the required time periods.&lt;/P&gt;</description>
    <pubDate>Fri, 02 Jun 2023 10:58:23 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2023-06-02T10:58:23Z</dc:date>
    <item>
      <title>How to schedule cron job for base report to run every 5 minutes outside specific hours?</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645522#M603</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I have a dashboard that runs off the back of a report that is scheduled to run every minute.&lt;BR /&gt;I need to amend the report schedule to run every minute between the specified hours AND every 5 minutes outside those hours to save on resources.&lt;/P&gt;
&lt;P&gt;My current cron expression looks like this:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;*/1 * * * *&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;To run every minute between the specified hours, I could write something like this.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;*/1 3-8,12-20 * * *&lt;/LI-CODE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The question I have is how to add a clause to schedule the search to run every 5 minutes outside those hours?&lt;/P&gt;
&lt;P&gt;Many thanks.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 14:45:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645522#M603</guid>
      <dc:creator>tomapatan</dc:creator>
      <dc:date>2023-06-02T14:45:20Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645524#M604</link>
      <description>&lt;P&gt;Try this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;*/5 0-2,9-11,21-23 * * *&lt;/LI-CODE&gt;&lt;P&gt;Note that is has to be a separate cron schedule or you adapt your report to check whether the search time fits in the required time periods.&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 10:58:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645524#M604</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-06-02T10:58:23Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645534#M605</link>
      <description>&lt;P&gt;Is it possible to add multiple cron schedules to a single base report ?&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 11:51:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645534#M605</guid>
      <dc:creator>tomapatan</dc:creator>
      <dc:date>2023-06-02T11:51:18Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645535#M606</link>
      <description>&lt;P&gt;I don't think that's possible although you might be able to use a saved search so both reports run from the same search.&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 11:56:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645535#M606</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-06-02T11:56:50Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645544#M607</link>
      <description>&lt;P&gt;Hello !&lt;BR /&gt;&lt;BR /&gt;As&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;suggested, you can use his complementary cron expression, but I think you will need to &lt;STRONG&gt;duplicate your first report&lt;/STRONG&gt;.&lt;/P&gt;&lt;P&gt;Should do the work, good luck !&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 12:22:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645544#M607</guid>
      <dc:creator>GaetanVP</dc:creator>
      <dc:date>2023-06-02T12:22:35Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645555#M608</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;&lt;P&gt;s other already said, you cannot add several schedules for one report. The real option is to duplicate that report and give to the both reports a separate schedules. Then you must update search query on both separately or try to use macro or maybe third savedsearch with loadjob can keep it on one place?&lt;/P&gt;&lt;P&gt;Are you absolutely sure that running this once a minute is something where your operative staff/other systems can react? In personally I try to avoid any schedule less than 5m or even 15minutes.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Btw. have you using MC and look that you have enough resources to run this (and other) queries with this frequency? Are there skipped or deferred seaches?&lt;/P&gt;&lt;P&gt;r. Ismo&lt;/P&gt;</description>
      <pubDate>Fri, 02 Jun 2023 13:12:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645555#M608</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2023-06-02T13:12:04Z</dc:date>
    </item>
    <item>
      <title>Re: Schedule cron job for base report</title>
      <link>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645785#M609</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;&lt;BR /&gt;The operational requirement is to run the report every minute, but I`m thinking to propose to run it every 5 mins outside of busy operational times.&lt;BR /&gt;We do have enough resources to run the queries, but would still like to optimise the search and frequency as much as possible.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;FONT face="inherit"&gt;Currently I`m using the report as a base search for my dashboard, but I`m not entirely sure how to call both of the reports, as &lt;/FONT&gt;suggested&lt;FONT face="inherit"&gt;&amp;nbsp;?&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;Many thanks.&lt;/P&gt;</description>
      <pubDate>Mon, 05 Jun 2023 14:54:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/How-to-schedule-cron-job-for-base-report-to-run-every-5-minutes/m-p/645785#M609</guid>
      <dc:creator>tomapatan</dc:creator>
      <dc:date>2023-06-05T14:54:20Z</dc:date>
    </item>
  </channel>
</rss>

