Alerting

How to write cron to schedule for an alert to trigger during last day of the month?

gndivya
Explorer

We have a requirement to extract all the admin users and give the report on last day of the month. I have the query to extract the admin users list from REST api which is currently triggered at 28th of every month considering Feb month.
Please help to write a cron for last day every month. If cron is not there (as I saw in many questions) please let me know what else can I write in my query to get the requirement complete.

0 Karma

larry02
New Member

Using cron job generator like crontab-generator.org should guide you set cron job correctly.

0 Karma

to4kawa
Ultra Champion

Crontab:

1: Minute (0-59)
2: Hours (0-23)
3: Day (0-31)
4: Month (0-12 [12 == December])
5: Day of the week(0-7 [7 or 0 == sunday])
/path/to/command – Script or command name to schedule

I see. I recommend, Create three.
1 the day of month end is "30"
2 the day of month end is "31"
3 Feb

"31" :
1 0 * 31 1,3,5,7,8,10,12 *
"30" :
1 0 * 30 4,6,9,11 *
"feb"
1 0 * 28 2 *

like that.

You can't do anything with just one.
cf. CronExpressions

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...