Alerting

How to set a query to run from Monday to sunday

Kwip
Contributor

Hi All,
I wan to run a query on every Monday morning 6AM. For this run I want set the days span as from Last Monday to Sunday. Say example,
If I am running the query on 11/06/2017 morning 6 AM, I want my query to run staring from 10/30/2017 to 11/05/2017.

As W0 is stands for Sunday and W1 is stands for Monday, I could not able to set W1 to earliest and W0 to latest.

Is there any other ways do this. Any kind help is much appreciated.

0 Karma
1 Solution

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

View solution in original post

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

Kwip
Contributor

This one also working fine. Thank a lot for your response!

0 Karma

mayurr98
Super Champion

hey @Kwip you are welcome,
You can accept my answer as well if you think the answer is relevant to your question.

0 Karma

Kwip
Contributor

I am having one more query. how to set the alert to run from 26 of last month to 25 of current month. Say example,
Every month day 1 I will run monthly report, for the run on December month the period should be 26th of October to 25th of November.

Please guide on the same.

0 Karma

skalliger
Motivator

Where is the problem? You simply save it as a scheduled alert with a Cron Expression as the following:

0 0 * * 1

the first "0" is the minute, the second "0" is the hour where it will be ran. The last 1 represents the first day of the week, monday.

Then, you simply write in the alert earliest: -7d@d, latest: -1d@d.

Did that answer your question?

Skalli

Kwip
Contributor

My Bad.. Really forget to think in this perspective.

Thanks a lot for your prompt response!!!

0 Karma

skalliger
Motivator

You're welcome. 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...