Alerting

How to set a query to run from Monday to sunday

Kwip
Contributor

Hi All,
I wan to run a query on every Monday morning 6AM. For this run I want set the days span as from Last Monday to Sunday. Say example,
If I am running the query on 11/06/2017 morning 6 AM, I want my query to run staring from 10/30/2017 to 11/05/2017.

As W0 is stands for Sunday and W1 is stands for Monday, I could not able to set W1 to earliest and W0 to latest.

Is there any other ways do this. Any kind help is much appreciated.

0 Karma
1 Solution

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

View solution in original post

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

Kwip
Contributor

This one also working fine. Thank a lot for your response!

0 Karma

mayurr98
Super Champion

hey @Kwip you are welcome,
You can accept my answer as well if you think the answer is relevant to your question.

0 Karma

Kwip
Contributor

I am having one more query. how to set the alert to run from 26 of last month to 25 of current month. Say example,
Every month day 1 I will run monthly report, for the run on December month the period should be 26th of October to 25th of November.

Please guide on the same.

0 Karma

skalliger
Motivator

Where is the problem? You simply save it as a scheduled alert with a Cron Expression as the following:

0 0 * * 1

the first "0" is the minute, the second "0" is the hour where it will be ran. The last 1 represents the first day of the week, monday.

Then, you simply write in the alert earliest: -7d@d, latest: -1d@d.

Did that answer your question?

Skalli

Kwip
Contributor

My Bad.. Really forget to think in this perspective.

Thanks a lot for your prompt response!!!

0 Karma

skalliger
Motivator

You're welcome. 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...