Cron Expression for Scheduled Alerts

[richard8]

Hi All,

Trying to configure an alert that runs on the first Sunday only of every month, specifically at 9:30am.

I put this as the cron expression: 30 9 1-7 * 0

If I'm reading the documentation correctly, that should be it. However, the alert appears to be running every Sunday of every month instead of just the first Sunday of every month.

Am I doing something wrong? Can't figure it out....

Thanks!

[kiran_panchavat]

@richard8 

This is your cron expression. Your cron expression 30 9 1-7 * 0 is not quite right because it triggers on any date (1-7) that is a Sunday (0), meaning it runs on every Sunday within the first seven days of the month. However, if the 1st of the month is not a Sunday, it will still run on other Sundays within that range.

[livehybrid · Accepted solution]

Its not possible within Splunk to have a crontab for the first Sunday of the month, however.. you might be able to run it every day for first 7 days of the month (`30 9 1-7 * *`) and add the following to your search:

| where strftime(now(),"%a")=="Sun"

This will stop the search from continuing if it isnt Sunday...

Does this help?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[richard8]

This worked well 🙂

Thanks!