Alerting

How to set a query to run from Monday to sunday

Kwip
Contributor

Hi All,
I wan to run a query on every Monday morning 6AM. For this run I want set the days span as from Last Monday to Sunday. Say example,
If I am running the query on 11/06/2017 morning 6 AM, I want my query to run staring from 10/30/2017 to 11/05/2017.

As W0 is stands for Sunday and W1 is stands for Monday, I could not able to set W1 to earliest and W0 to latest.

Is there any other ways do this. Any kind help is much appreciated.

0 Karma
1 Solution

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

View solution in original post

mayurr98
Super Champion

try this :
earliest=-6d@w0 latest=@w0

let me know if it works!

Kwip
Contributor

This one also working fine. Thank a lot for your response!

0 Karma

mayurr98
Super Champion

hey @Kwip you are welcome,
You can accept my answer as well if you think the answer is relevant to your question.

0 Karma

Kwip
Contributor

I am having one more query. how to set the alert to run from 26 of last month to 25 of current month. Say example,
Every month day 1 I will run monthly report, for the run on December month the period should be 26th of October to 25th of November.

Please guide on the same.

0 Karma

skalliger
Motivator

Where is the problem? You simply save it as a scheduled alert with a Cron Expression as the following:

0 0 * * 1

the first "0" is the minute, the second "0" is the hour where it will be ran. The last 1 represents the first day of the week, monday.

Then, you simply write in the alert earliest: -7d@d, latest: -1d@d.

Did that answer your question?

Skalli

Kwip
Contributor

My Bad.. Really forget to think in this perspective.

Thanks a lot for your prompt response!!!

0 Karma

skalliger
Motivator

You're welcome. 🙂

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...