https://community.splunk.com/t5/Reporting/Monthly-Saved-Search-For-Previous-Month/m-p/67672#M1559 <P>Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it</P> <PRE><CODE>10 0 1 * * </CODE></PRE> <P>So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.</P> <P>The start and end time look correct.</P> Tue, 18 Dec 2012 21:52:04 GMT lguinn2 2012-12-18T21:52:04Z https://community.splunk.com/t5/Reporting/Monthly-Saved-Search-For-Previous-Month/m-p/67671#M1558 <P>I'd like to create a saved search that run monthly for the previous month. I know how to do that in the Search app, but when creating a saved search, I don't see those options.</P> <P>I am going to try and schedule cron 0 0 1 * * and fill the Start Time with "-1mon@mon" and the End Time with "@mon".</P> <P>Is that going to work?</P> Tue, 18 Dec 2012 21:02:10 GMT https://community.splunk.com/t5/Reporting/Monthly-Saved-Search-For-Previous-Month/m-p/67671#M1558 peasead 2012-12-18T21:02:10Z https://community.splunk.com/t5/Reporting/Monthly-Saved-Search-For-Previous-Month/m-p/67672#M1559 <P>Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it</P> <PRE><CODE>10 0 1 * * </CODE></PRE> <P>So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.</P> <P>The start and end time look correct.</P> Tue, 18 Dec 2012 21:52:04 GMT https://community.splunk.com/t5/Reporting/Monthly-Saved-Search-For-Previous-Month/m-p/67672#M1559 lguinn2 2012-12-18T21:52:04Z