How to schedule a Cron alert every 2 weeks on a Sunday at 11pm?

[geninf5]

How do I schedule a Cron alert or report to run every 2 weeks on a specific day.  I need it to run at end of day of every other Sunday.

[shalomsuresh]

@geninf5 @gcusello 

I had a similar requirement, and I solved it using a combination of a cron schedule and a condition in the search query. It's just two steps, first to setup a weekly schedule and then a condition to return result only once every two weeks.

1. Set up weekly cron schedule. For example, to run at 6 p.m.  on every Sunday, use:
   0 18 * * 0

2. Add the following condition to your search query, placing it where the query runs efficiently without affecting the final output:
   | eval biweekly_cycle_start=1726977600, biweekly=round(((relative_time(now(),"@d")-biweekly_cycle_start)/86400),0)%14 | where biweekly=0

In this example, I introduced a reference epoch time, biweekly_cycle_start, to calculate the two-week cycle. It represents the epoch time for two weeks before the alert schedule's starting date.

For instance, if your schedule begins on October 6, 2024, use the epoch time for the start of the day, September 22, 2024, which is 1726977600.

Each time the alert runs, the condition checks whether two weeks have passed since the last run. It returns results every two weeks and no results on the off week (seven days from the previous run).

Simply insert this condition where it will optimize the search performance, before the final transforming commands like stats, top, table, etc.

[gcusello]

Hi @geninf5,

as @johnhuang said, it isn't possible to schedule an execution every two weeks only using cron.

You could schedule your execution every week and inside search put a condition to exclude results in the II and IV weeks.

Ciao.

Giuseppe

[johnhuang]

Cron doesn't support every other week -- the closest is something like 1st and 3rd sunday every month.