How to edit my cron expression to run a Scheduled Report on data for the previous weekday (not Saturday or Sunday)?


I've got a report that I want to schedule to run in the early morning and process and present a bunch of data from the previous day. So, run at 6AM on a Tuesday morning to gather all of Monday's data and display that until Wednesday morning. I don't want to display the data for Saturday and Sunday - on Monday. I want to see Friday's data.

My date range is set to "yesterday" on my report and that seems to be working fine. But I'm using the following cron expression: 0 6 * * 2-6 and it seems to only run Tuesday-Friday, not Tuesday-Saturday as I expected. On Monday I see Thursday's data (which I had already seen on Friday), instead of Friday's, and all of the other days are correct. Is there some reason my cron expression isn't causing the search to run on Saturday morning?

0 Karma


You could use the time functions in the search itself and just cron it for the same time every day.

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

I grabbed this little bit of code from here.

0 Karma

Revered Legend

The cron looks good to me (reference*_*_2-6). How are you getting the report content, email? If yes for email, then when you say on Mon you see data for Thu, does that mean you get another email on Sat which still showing data for Thu?

0 Karma


I'm displaying the data in a dashboard that's relying on the scheduled report. So if I look on Tuesday, I see Monday's data, as intended. I also see Thursday's data on Friday, as intended. But on Monday I see Thursday's data, when I would have expected to see Friday's.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...