Alerting

How to write cron to schedule for an alert to trigger during last day of the month?

gndivya
Explorer

We have a requirement to extract all the admin users and give the report on last day of the month. I have the query to extract the admin users list from REST api which is currently triggered at 28th of every month considering Feb month.
Please help to write a cron for last day every month. If cron is not there (as I saw in many questions) please let me know what else can I write in my query to get the requirement complete.

0 Karma

larry02
New Member

Using cron job generator like crontab-generator.org should guide you set cron job correctly.

0 Karma

to4kawa
Ultra Champion

Crontab:

1: Minute (0-59)
2: Hours (0-23)
3: Day (0-31)
4: Month (0-12 [12 == December])
5: Day of the week(0-7 [7 or 0 == sunday])
/path/to/command – Script or command name to schedule

I see. I recommend, Create three.
1 the day of month end is "30"
2 the day of month end is "31"
3 Feb

"31" :
1 0 * 31 1,3,5,7,8,10,12 *
"30" :
1 0 * 30 4,6,9,11 *
"feb"
1 0 * 28 2 *

like that.

You can't do anything with just one.
cf. CronExpressions

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...