topic Re: Saved Search Cron Error? in Reporting

Saved Search Cron Error?

stevensa — Mon, 28 Mar 2011 19:17:14 GMT

Hey Everyone,

Thanks for taking the time to help!

I have a series of saved searches that are supposed to be running every three minutes after 1am Tuesday-Saturday to report for previous day information:

0 1 * * 2-6
3 1 * * 2-6
6 1 * * 2-6
9 1 * * 2-6
etc...

However, these searches are not running on Saturdays. They run fine Tuesday-Friday but then do not run on Saturday. Can anyone point me in the right direction for what I am doing wrong? Really appreciate your help!

Adam

Re: Saved Search Cron Error?

yannK — Tue, 29 Mar 2011 00:44:17 GMT

You cron seems correct

Can you try to list the days 0 1 * * 2,3,4,5,6

Remark: there is no 6th parameter for year in splunk.

Re: Saved Search Cron Error?

stevensa — Wed, 30 Mar 2011 01:02:22 GMT

Yannk,
Thank you for your response! Splunk does not like the addition of the final star (Currently using 4.1.7, with the 4.2 ugprade expected in a few weeks!). However, I will try explicitly listing the days and report on that Monday.
Thanks again for the suggestion!

Adam

Re: Saved Search Cron Error?

yannK — Thu, 07 Apr 2011 23:34:27 GMT

I confirm, there is no year in the splnuk cron notation. (I edited my answer)