Reporting

How to edit my cron expression to run a Scheduled Report on data for the previous weekday (not Saturday or Sunday)?

Stuarth09
Explorer

I've got a report that I want to schedule to run in the early morning and process and present a bunch of data from the previous day. So, run at 6AM on a Tuesday morning to gather all of Monday's data and display that until Wednesday morning. I don't want to display the data for Saturday and Sunday - on Monday. I want to see Friday's data.

My date range is set to "yesterday" on my report and that seems to be working fine. But I'm using the following cron expression: 0 6 * * 2-6 and it seems to only run Tuesday-Friday, not Tuesday-Saturday as I expected. On Monday I see Thursday's data (which I had already seen on Friday), instead of Friday's, and all of the other days are correct. Is there some reason my cron expression isn't causing the search to run on Saturday morning?

0 Karma

JDukeSplunk
Builder

You could use the time functions in the search itself and just cron it for the same time every day.

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

I grabbed this little bit of code from here.
https://answers.splunk.com/answers/136802/function-to-return-last-weekday.html

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The cron looks good to me (reference http://crontab.guru/#0_6_*_*_2-6). How are you getting the report content, email? If yes for email, then when you say on Mon you see data for Thu, does that mean you get another email on Sat which still showing data for Thu?

0 Karma

Stuarth09
Explorer

I'm displaying the data in a dashboard that's relying on the scheduled report. So if I look on Tuesday, I see Monday's data, as intended. I also see Thursday's data on Friday, as intended. But on Monday I see Thursday's data, when I would have expected to see Friday's.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...