Cron notation for Bi-Weekly schedule PDF delivery dashboard in Splunk

[kzkk]

Hello all, I would like to generate a scheduled PDF delivery dashboard for bi-weekly (every two weeks) on Friday. But if I use " 0 0 */14 * * ", the schedule doesn't run exactly every 14 days. It runs only on the 14th and 29th days of the month. And I want to run it on only Friday of every two weeks. So, I try cron notation " 0 0 */14 * 5 ". But, the schedule run on not only the 14th and 29th days of the month, but also every Friday. What kind of notation has to be used to meet both conditions for every 14 days and on Friday? And also is it possible to run the cron schedule at the end of every month?

[dural_yyz]

<deleted my own answer>

[shalomsuresh]

@kzkk  You would have found an alternate way but this maybe useful in the future,

I had a similar requirement, and I solved it using a combination of a cron schedule and a condition in the search query. It's just two steps, first to setup a weekly schedule and then a condition to return result only once every two weeks.

1. Set up weekly cron schedule. For example, to run at 6 p.m.  on every Sunday, use:
   0 18 * * 0

2. Add the following condition to your search query, placing it where the query runs efficiently without affecting the final output:
   | eval biweekly_cycle_start=1726977600, biweekly=round(((relative_time(now(),"@d")-biweekly_cycle_start)/86400),0)%14 | where biweekly=0

In this example, I introduced a reference epoch time, biweekly_cycle_start, to calculate the two-week cycle. It represents the epoch time for two weeks before the alert schedule's starting date.

For instance, if your schedule begins on October 6, 2024, use the epoch time for the start of the day, September 22, 2024, which is 1726977600.

Each time the alert runs, the condition checks whether two weeks have passed since the last run. It returns results every two weeks and no results on the off week (seven days from the previous run).

Simply insert this condition where it will optimize the search performance, before the final transforming commands like stats, top, table, etc.

[PickleRick]

Yes, that's some approach to the problem but while it might not make a big difference for a simple and lightweight search if your search is a big and heavy report you'd still be running it and stressing your servers. It's just that you wouldn't get any results back.

[shalomsuresh]

Yep.. true. Its just once in a week. Its like we are utilising the splunk resource for the search but not making use of it. But, it still works the way we wanted it to work 🙂

I tried to run this condition separately in a subsearch to avoid running the entire search, it worked for few days before it stopped working recently, not sure if version upgrade or something caused it.
[| makeresults | eval biweekly_cycle_start=1726977600, biweekly=round(((relative_time(now(),"@d")-biweekly_cycle_start)/86400),0)%14 | where biweekly=0]

It would be smooth if there's a way similar to this.

[PickleRick]

Actually that is an interesting train of thought. You could do this to conditionally create a set of "easily not-fulfillable" conditions. Like some non-existent sourcetype being set only on those days you don't want the search to run.

[PickleRick]

The answer is "no" and "no". You can't do that with simple cron schedules.

What is not explained in splunk docs but how your typical cron schedule works is that if you specify day of the month as well as day of the week, the task is launched when any of those conditions are met. So your task would be launched at 14th and 28th of the month as well as on every friday.

There is no way to say "biweekly" or "end of the month". Cron is a simple tool after all 😉

[kzkk]

So, I can't do anything for a bi-weekly schedule using a cron schedule, right? Thank you for the reply.

[PickleRick]

I can't think of anynway to specify it with a cron schedule.

If it was, for example, a normal unix script that was run from cron, I'd set a weekly schedule and checked week number within the script itself. But with a search... no idea.