Archive

Cron expression for first two mondays of every month

Engager

I need a cron expression that would run a report on first two mondays of every month.What would be the expression?Thanks in advance

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Not sure how flexible the cron syntax is within Splunk so mabe you could try with:

0 8 1-14 * 1

Which reads as: At 08:00 on every day-of-month from 1 through 14 that is also a Monday.

Engager

Thanks Javiergn but it's not the requirement I want.Canwe make any changes at the last number ie 1 which shows Monday?

0 Karma

SplunkTrust
SplunkTrust

What's your actual requirement?
You can make any changes you like, syntax is as follows:

*    *    *    *   *
-     -     -     -    -
|    |    |    |   |
|    |    |    |   +----- day of week (0 - 6) (Sunday=0)
|    |    |    +------- month (1 - 12)
|    |    +--------- day of month (1 - 31)
|    +----------- hour (0 - 23)
+------------- min (0 - 59)
0 Karma

Engager

You might be correct.I took 1-14 as dates not as day.Thanks.And sorry also my mistake

0 Karma

SplunkTrust
SplunkTrust

No worries. Please don't forget to confirm the answer once you have verified it fully works for you.
I'm still not 100% sure anymore given what ckrishnaguturi mentioned above so you are going to have to test and let us know.

0 Karma

The expression will give the alerts at 08:00 on every day-of-month from 1 through 14 and on Monday

SplunkTrust
SplunkTrust

You might be right. Don't have my lab to test this but I'm finding contradictory answers online:

See for instance:

http://cronexpressiondescriptor.azurewebsites.net/?Language=en-US&DayOfWeekStartIndexOne=false&Use24...

VS

http://corntab.com/?c=0_8_1-14/7_*_1

I don't have my lab to test this at the moment sorry

0 Karma