topic Re: Cron Expression for Scheduled Alerts in Alerting

Cron Expression for Scheduled Alerts

richard8 — Tue, 11 Feb 2025 19:28:59 GMT

Hi All,

Trying to configure an alert that runs on the first Sunday only of every month, specifically at 9:30am.

I put this as the cron expression: 30 9 1-7 * 0

If I'm reading the documentation correctly, that should be it. However, the alert appears to be running every Sunday of every month instead of just the first Sunday of every month.

Am I doing something wrong? Can't figure it out....

Thanks!

Re: Cron Expression for Scheduled Alerts

livehybrid — Tue, 11 Feb 2025 20:37:55 GMT

Its not possible within Splunk to have a crontab for the first Sunday of the month, however.. you might be able to run it every day for first 7 days of the month (`30 9 1-7 * *`) and add the following to your search:

| where strftime(now(),"%a")=="Sun"

This will stop the search from continuing if it isnt Sunday...

Does this help?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

Re: Cron Expression for Scheduled Alerts

kiran_panchavat — Wed, 12 Feb 2025 05:11:43 GMT

@richard8

This is your cron expression. Your cron expression 30 9 1-7 * 0 is not quite right because it triggers on any date (1-7) that is a Sunday (0), meaning it runs on every Sunday within the first seven days of the month. However, if the 1st of the month is not a Sunday, it will still run on other Sundays within that range.

Re: Cron Expression for Scheduled Alerts

richard8 — Wed, 12 Feb 2025 22:03:05 GMT

This worked well 🙂

Thanks!