How to edit my cron expression to run a Scheduled Report on data for the previous weekday (not Saturday or Sunday)?


I've got a report that I want to schedule to run in the early morning and process and present a bunch of data from the previous day. So, run at 6AM on a Tuesday morning to gather all of Monday's data and display that until Wednesday morning. I don't want to display the data for Saturday and Sunday - on Monday. I want to see Friday's data.

My date range is set to "yesterday" on my report and that seems to be working fine. But I'm using the following cron expression: 0 6 * * 2-6 and it seems to only run Tuesday-Friday, not Tuesday-Saturday as I expected. On Monday I see Thursday's data (which I had already seen on Friday), instead of Friday's, and all of the other days are correct. Is there some reason my cron expression isn't causing the search to run on Saturday morning?

0 Karma


You could use the time functions in the search itself and just cron it for the same time every day.

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

I grabbed this little bit of code from here.

0 Karma

Revered Legend

The cron looks good to me (reference*_*_2-6). How are you getting the report content, email? If yes for email, then when you say on Mon you see data for Thu, does that mean you get another email on Sat which still showing data for Thu?

0 Karma


I'm displaying the data in a dashboard that's relying on the scheduled report. So if I look on Tuesday, I see Monday's data, as intended. I also see Thursday's data on Friday, as intended. But on Monday I see Thursday's data, when I would have expected to see Friday's.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...