Alerting

How to write cron to schedule for an alert to trigger during last day of the month?

gndivya
Explorer

We have a requirement to extract all the admin users and give the report on last day of the month. I have the query to extract the admin users list from REST api which is currently triggered at 28th of every month considering Feb month.
Please help to write a cron for last day every month. If cron is not there (as I saw in many questions) please let me know what else can I write in my query to get the requirement complete.

0 Karma

larry02
New Member

Using cron job generator like crontab-generator.org should guide you set cron job correctly.

0 Karma

to4kawa
Ultra Champion

Crontab:

1: Minute (0-59)
2: Hours (0-23)
3: Day (0-31)
4: Month (0-12 [12 == December])
5: Day of the week(0-7 [7 or 0 == sunday])
/path/to/command – Script or command name to schedule

I see. I recommend, Create three.
1 the day of month end is "30"
2 the day of month end is "31"
3 Feb

"31" :
1 0 * 31 1,3,5,7,8,10,12 *
"30" :
1 0 * 30 4,6,9,11 *
"feb"
1 0 * 28 2 *

like that.

You can't do anything with just one.
cf. CronExpressions

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...