Report cron schedule not running correctly anymore

Path Finder

I had a report that would run on the first Thursday of every month. It had been working for months. Recently, it startign running more than I expected based on how the cron was written, and the only thing I can attribute it to at the moment is that we upgraded to 7.3.4 from 6.1.1(I think).

The cron is: 0 4 1-8 * 4

What it is doing now is running every day from the 1st to the 8th of every month, and running every Thursday at 4 am.

0 Karma


According to the report is running exactly when you said it should.
Either the old behavior was a bug this now fixed or the cron "standard" has changed since 6.1.1.
If there is no mention of this change in any of the release notes since 6.1.2 then you should file a bug report. Otherwise, submit an enhancement request at

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...