Alerting

Alert scheduling - cron expression not working as expected

mattbg
Path Finder

I'm trying to schedule a particular alert to run on the first Monday of each fiscal quarter using this cron expression:

 

0 9 1-7 2,5,8,11 1

 

My reading of this is "9:00am on the first Monday of Feb, May, Aug, and Nov".

However, with this month being November (11) for some reason it is running it every Monday. It unexpectedly ran this past Mon Nov 16th and has a "next scheduled time" of Mon Nov 23rd. Given the day-of-month restriction (3rd field) of 1-7 I would not have expected this to happen.

Any advice appreciated. Splunk Enterprise 8.0.6. Thanks.

Labels (2)
0 Karma
1 Solution

teunlaan
Contributor

It's not a bug, crontab.guru gives the correct explenation.

"At 09:00 on every day-of-month from 1 through 7 and on Monday in February, May, August, and November.”

the 16th was a Monday

 

 

View solution in original post

mattbg
Path Finder

I ended up using this cron expression to run on monthdays 1-7 regardless of the weekday:

 

0 9 1-7 2,5,8,11 *

 

...and then filtering my results so that I only got results on Mondays:

 

…
| eval today_weekday=strftime(now(), “%w”)
| where today_weekday=1

 

I couldn't use a time range filter because the underlying data can be generated at any time and the alert just sends the most recent results that exist at the start of the quarter.

teunlaan
Contributor

It's not a bug, crontab.guru gives the correct explenation.

"At 09:00 on every day-of-month from 1 through 7 and on Monday in February, May, August, and November.”

the 16th was a Monday

 

 

richgalloway
SplunkTrust
SplunkTrust

According to crontab.guru, that cron expression means "At 09:00 on every day-of-month from 1 through 7 and on Monday in February, May, August, and November.” (https://crontab.guru/#0_9_1-7_2,5,8,11_1)

That the alert ran on the 16th seems like a bug to me.  I suggest opening a support request with Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...