How to configure an alert to run on the first business day of the month?

[Anoma]

Hi Experts,

My alert was working fine with this cron schedule from last few months:

0 7 1 * *

But this month (July), first day of month was Saturday and the job linked with it doesn't run on weekend hence my monthly alert didn't trigger. 

Can someone please help me to configure my alert to run at 7 AM on first  Monday of the month, please?

[isoutamo]

Hi

you cannot do this by cron only. Cron haven’t any information if day is bank holiday or normal business day. You could configure cron to run this on first Monday of month like described here https://community.splunk.com/t5/Splunk-Search/Why-does-my-Cron-for-Sunday-fail/m-p/615256#M213817 Then you must add additional selection to your SPL to use e.g. lookup to check if day is bank holiday or business day. This can be quite tricky as actually 1st business Monday could be at least 2nd Monday or maybe 3rd (I don’t know all possible versions over the world).

r. Ismo