topic Re: Why does my Cron for Sunday fail? in Splunk Search

Why does my Cron for Sunday fail?

dlcrooks — Thu, 29 Sep 2022 18:28:30 GMT

According to the docs for cron the Sunday code is 0.

When I try to run this cron for the first Sunday of the month it displays Saturday!

00 12 1,2,3,4,5,6,7 * 0

Of course, when I use 6 for Saturday, it works!

00 12 1,2,3,4,5,6,7 * 6

What code am I supposed to use for Sunday?

TIA!

David

Re: Why does my Cron for Sunday fail?

isoutamo — Thu, 29 Sep 2022 20:13:24 GMT

Interesting, also this https://crontab.guru/#00_12_1,2,3,4,5,6,7_*_0 shows that expression is correct and should run at 12:00 on 1st Sun on every month.

Re: Why does my Cron for Sunday fail?

dlcrooks — Thu, 29 Sep 2022 20:23:27 GMT

i am trying to schedule for this weekend and Splunk is not helping

Re: Why does my Cron for Sunday fail?

gcusello — Fri, 30 Sep 2022 06:08:39 GMT

Hi @dlcrooks,

I don't know why this happens, I should have your data to check, but anyway, as a workaround, you could put a filter in your main search to be sure that your alert is executed only the first Monday in a month, something like this:

<your_search> date_mday<7 date_wday=sunday

Ciao.

Giuseppe

Re: Why does my Cron for Sunday fail?

dlcrooks — Fri, 30 Sep 2022 13:16:34 GMT

My data has nothing to do with the cron string not working in Splunk. That is a bug in Splunk.

I will try out your suggestion.

Thanks!

David

Re: Why does my Cron for Sunday fail?

isoutamo — Fri, 30 Sep 2022 14:01:59 GMT

When you are expecting that this is a bug, please send bug report to Splunk Support!

Re: Why does my Cron for Sunday fail?

dlcrooks — Fri, 30 Sep 2022 14:48:51 GMT

No, I tried the suggestion and I do not want to filter my data as I need the search scheduled.

Re: Why does my Cron for Sunday fail?

thall79 — Thu, 20 Oct 2022 20:29:49 GMT

When I click on the link for https://crontab.guru/#00_12_1,2,3,4,5,6,7_*_0 the next run date is at 2022-10-23 12:00:00 which is not the first Sunday Nov 6th 2022.

I did some digging and found if you use the following: 00 12 1-7 * */7 (https://crontab.guru/#00_12_1-7_*_*/7) in crontab it appears to be what you are looking for.

However when I attempt to use that cron in a Splunk schedule it does not work. It appears that Splunk is not like the every 7th day trick */7.

Reviewing Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/CronExpressions

It appears the only values that can be used are 0-6. Not sure if at this time if there is a way to run on the first Sunday of the month with cron in Splunk.

travis

Re: Why does my Cron for Sunday fail?

dlcrooks — Thu, 20 Oct 2022 20:32:40 GMT

So, if the values are 0-6 then Sunday is 0 instead of 7... I will have to play with it some more myself.

Thanks!

David L. Crooks

Re: Why does my Cron for Sunday fail?

thall79 — Thu, 20 Oct 2022 21:37:01 GMT

I was thinking the same thing, but when I plugged in 0 instead of 7 Splunk gives me an error of invalid cron_schedule. Now I did get 1 to work, but that was not helpful and seems the job will start on Nov 1st and then run everyday according to crontab.guru.

travis

Re: Why does my Cron for Sunday fail?

dlcrooks — Fri, 21 Oct 2022 13:53:05 GMT

I think an issue is that the cron parser in Splunk is not the same as crontab.guru. I wish it was...