How to edit my cron expression to run a Scheduled Report on data for the previous weekday (not Saturday or Sunday)?

[Stuarth09]

I've got a report that I want to schedule to run in the early morning and process and present a bunch of data from the previous day. So, run at 6AM on a Tuesday morning to gather all of Monday's data and display that until Wednesday morning. I don't want to display the data for Saturday and Sunday - on Monday. I want to see Friday's data.

My date range is set to "yesterday" on my report and that seems to be working fine. But I'm using the following cron expression: 0 6 * * 2-6 and it seems to only run Tuesday-Friday, not Tuesday-Saturday as I expected. On Monday I see Thursday's data (which I had already seen on Friday), instead of Friday's, and all of the other days are correct. Is there some reason my cron expression isn't causing the search to run on Saturday morning?

[JDukeSplunk]

You could use the time functions in the search itself and just cron it for the same time every day.

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

I grabbed this little bit of code from here.
https://answers.splunk.com/answers/136802/function-to-return-last-weekday.html

[somesoni2]

The cron looks good to me (reference http://crontab.guru/#0_6_*_*_2-6). How are you getting the report content, email? If yes for email, then when you say on Mon you see data for Thu, does that mean you get another email on Sat which still showing data for Thu?

[Stuarth09]

I'm displaying the data in a dashboard that's relying on the scheduled report. So if I look on Tuesday, I see Monday's data, as intended. I also see Thursday's data on Friday, as intended. But on Monday I see Thursday's data, when I would have expected to see Friday's.