<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Set Specific Start Time For Scheduled Search in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300752#M5572</link>
    <description>&lt;P&gt;Hi IRHM73,&lt;BR /&gt;
please some additional information:&lt;BR /&gt;
do you want to schedule your search to a specific date  (e.g. 08/07/2017), or to a fixed day of the week (e.g. every friday)  or e.g. every hour from a specific date?&lt;BR /&gt;
About scheduler see &lt;A href="https://en.wikipedia.org/wiki/Cron"&gt;https://en.wikipedia.org/wiki/Cron&lt;/A&gt; or &lt;A href="http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html"&gt;http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html&lt;/A&gt;&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;in the first case schedule your crontab in the week of your date and set your scheduler to &lt;CODE&gt;0 0 * * 7&lt;/CODE&gt; and disable scheduler before the second run &lt;/LI&gt;
&lt;LI&gt;in the second case schedule your crontab in the week of your date and set your scheduler to &lt;CODE&gt;0 0 * * 7&lt;/CODE&gt; &lt;/LI&gt;
&lt;LI&gt;if instead your want to schedule e.g. every hour from a starting date, set your scheduler to &lt;CODE&gt;0 * * * *&lt;/CODE&gt; in the
hour before the first wanted run.&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
    <pubDate>Fri, 07 Jul 2017 07:48:42 GMT</pubDate>
    <dc:creator>gcusello</dc:creator>
    <dc:date>2017-07-07T07:48:42Z</dc:date>
    <item>
      <title>Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300751#M5571</link>
      <description>&lt;P&gt;Hi, I wonder if someone could help me please.&lt;/P&gt;

&lt;P&gt;I'm creating a scheduled search which will run every day with the following advanced time ranges:&lt;/P&gt;

&lt;P&gt;Start date = -1d@d&lt;BR /&gt;
Latest date = @d&lt;/P&gt;

&lt;P&gt;The problem I have is that I want to set the scheduled search to start running on specific date then continue with the schedule.&lt;/P&gt;

&lt;P&gt;I've been into the "Advanced edit" and changed the "next_scheduled_time" to show the date I'd like it start on i.e. 09 July, but this doesn't change the date when I look at the report in the list.&lt;/P&gt;

&lt;P&gt;Could anyone perhaps point out where I've gone wrong please?&lt;/P&gt;

&lt;P&gt;Many thanks and kind regards&lt;/P&gt;

&lt;P&gt;Chris&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:48:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300751#M5571</guid>
      <dc:creator>IRHM73</dc:creator>
      <dc:date>2020-09-29T14:48:09Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300752#M5572</link>
      <description>&lt;P&gt;Hi IRHM73,&lt;BR /&gt;
please some additional information:&lt;BR /&gt;
do you want to schedule your search to a specific date  (e.g. 08/07/2017), or to a fixed day of the week (e.g. every friday)  or e.g. every hour from a specific date?&lt;BR /&gt;
About scheduler see &lt;A href="https://en.wikipedia.org/wiki/Cron"&gt;https://en.wikipedia.org/wiki/Cron&lt;/A&gt; or &lt;A href="http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html"&gt;http://www.quartz-scheduler.org/documentation/quartz-2.x/tutorials/crontrigger.html&lt;/A&gt;&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;in the first case schedule your crontab in the week of your date and set your scheduler to &lt;CODE&gt;0 0 * * 7&lt;/CODE&gt; and disable scheduler before the second run &lt;/LI&gt;
&lt;LI&gt;in the second case schedule your crontab in the week of your date and set your scheduler to &lt;CODE&gt;0 0 * * 7&lt;/CODE&gt; &lt;/LI&gt;
&lt;LI&gt;if instead your want to schedule e.g. every hour from a starting date, set your scheduler to &lt;CODE&gt;0 * * * *&lt;/CODE&gt; in the
hour before the first wanted run.&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Fri, 07 Jul 2017 07:48:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300752#M5572</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2017-07-07T07:48:42Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300753#M5573</link>
      <description>&lt;P&gt;Hi @cusello, I'm sorry for not providing enough information.&lt;/P&gt;

&lt;P&gt;I have a report which will update a Summary index which I've scheduled as 'one -off' job to extract data from 01/03/17 to 07/07/17.&lt;/P&gt;

&lt;P&gt;I then want to run the job I raised my question about to extract data for the previous 24 hours, so I will want to run this on the 09 July to extract data from the previous day and to continue doing this each day.&lt;/P&gt;

&lt;P&gt;I hope this helps&lt;/P&gt;

&lt;P&gt;Many thanks&lt;/P&gt;

&lt;P&gt;Chris&lt;/P&gt;</description>
      <pubDate>Fri, 07 Jul 2017 07:57:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300753#M5573</guid>
      <dc:creator>IRHM73</dc:creator>
      <dc:date>2017-07-07T07:57:38Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300754#M5574</link>
      <description>&lt;P&gt;Hi IRHM73,,&lt;BR /&gt;
I had this problem configuring BlueCoat Proxies App:&lt;/P&gt;

&lt;P&gt;At first you can schedule your search to run once for the previous seven days five minutes after using as time period ealiest=-7d@d latest=@d:&lt;BR /&gt;
e,g, if yout time is 9.30, schedule your report &lt;CODE&gt;35 9 * * *&lt;/CODE&gt; using  as time period &lt;CODE&gt;ealiest=-7d@d latest=@d&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;After the end of your execution, schedule your search to run every day (e.g. at 7.00) &lt;CODE&gt;0 7 * * *&lt;/CODE&gt; using  as time period &lt;CODE&gt;ealiest=-d@d latest=@d&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Fri, 07 Jul 2017 08:21:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300754#M5574</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2017-07-07T08:21:00Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300755#M5575</link>
      <description>&lt;P&gt;Hi @cusello, thank you for coming back to me with this.&lt;/P&gt;

&lt;P&gt;So I take it by this, there is not way to set a future date, and should be set as two separate jobs setting the second when the first has run?&lt;/P&gt;

&lt;P&gt;Many thanks&lt;/P&gt;

&lt;P&gt;Chris&lt;/P&gt;</description>
      <pubDate>Fri, 07 Jul 2017 08:29:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300755#M5575</guid>
      <dc:creator>IRHM73</dc:creator>
      <dc:date>2017-07-07T08:29:41Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300756#M5576</link>
      <description>&lt;P&gt;Hi IRHM73,&lt;BR /&gt;
I don't know but why you need to schedule two separate jobs?&lt;BR /&gt;
As described you can schedule the first one shot job near-immediately (e.g. 5 minutes after your present time) so you can immediately check results and after job end schedule the daily run.&lt;/P&gt;

&lt;P&gt;I did it and I obtained my goal!&lt;/P&gt;

&lt;P&gt;Eventually, you could schedule also an alert to know if there were some problems in daily job execution to manually repeat the failed ones.&lt;/P&gt;

&lt;P&gt;Bye.&lt;BR /&gt;
Giuseppe&lt;/P&gt;</description>
      <pubDate>Fri, 07 Jul 2017 09:34:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300756#M5576</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2017-07-07T09:34:56Z</dc:date>
    </item>
    <item>
      <title>Re: Set Specific Start Time For Scheduled Search</title>
      <link>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300757#M5577</link>
      <description>&lt;P&gt;Hi @cusello, yes you're right, thank you for the guidance.&lt;/P&gt;

&lt;P&gt;Kind Regards&lt;/P&gt;

&lt;P&gt;Chris&lt;/P&gt;</description>
      <pubDate>Mon, 10 Jul 2017 07:11:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Set-Specific-Start-Time-For-Scheduled-Search/m-p/300757#M5577</guid>
      <dc:creator>IRHM73</dc:creator>
      <dc:date>2017-07-10T07:11:20Z</dc:date>
    </item>
  </channel>
</rss>

