Reporting

How to schedule a report email with a CSV attachment of search results every 4 hours?

Laya123
Communicator

Hi,

Can any one help me on how to schedule a report with an attachment (csv) and email to my boss every 4 hours with last 4 hours of search results? I used cron expression 0 */4 * * *, but it's not generating a report every 4 hours.

Example: Email a report for every 4 hours; first email has to be sent at 4am for the results of last 4 hours (1am - 4am). The second email has to be sent at 8am for the results of 5am to 8am

Please help me to do this

Thanks in advance

0 Karma
1 Solution

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

View solution in original post

woodcock
Esteemed Legend

The cron syntax works like this.

.---------------- minute (0 - 59)
|  .------------- hour (0 - 23)
|  |  .---------- day of month (1 - 31)
|  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
|  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
|  |  |  |  |
*  *  *  *  *

To run your search every minute on 4 hour intervals (every minute within every 4th hour), use this cron.

* */4 * * *

To run your search once every 4 hours (on the zero minute), use this cron.

0 */4 * * *

You can also specify an enumerated list, if you need to drop off midnight (your example may mean this), like this:

0 4,8,12,16,20 * * *

woodcock
Esteemed Legend

Please "Accept" this answer.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, 0 */4 * * * will run once every four hours, at zero minutes past 0, 4, 8, 12, 16, 20.

0 Karma

Laya123
Communicator

Hi,

I am bit confused can you tell me

0 */4 * * * - does this cron help to get an email every 4 hours?

Thanks

0 Karma

Laya123
Communicator

Thanks for your immediate response

it means email will go for every 4hours with last 4hours of results right

Thanks

0 Karma

woodcock
Esteemed Legend

The "last 4 hours" part is controlled by the time specifier which should be -4h@h.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...