I think the answer is that it is not easily possible in crontab on the OS level and I don't think you'll have hence luck with any cron expression within Splunk.
I also think the the solution referenced in the comment above may not work due to crontab's evaluation of day and month specification. It will likely cause the search to run on all listed days AND on Tuesdays, i.e. be a OR vs. an AND evaluation.
Just out of curiosity: What would be the impact if your search runs every Tuesday? If you want to prevent reports being sent out as a result of the search, you may be able to add some SPL magic to your search that determines whether the current day is the second Tuesday of a month and sets a field to true/false. Example (you need to validate this does what it should):
| eval daynumber=strftime(now(),"%d"), weekday=strftime(now(),"%a"), isSecondTuesday=if(weekday=="Tue" AND daynumber>7 AND daynumber<14, "true", "false" )
Wrap it in a macro to not clutter your reporting search and make it reusable. You can then add a custom alert condition, like search isSecondTuesday="true" to your scheduled report and it will not trigger the alert action (i.e. send the email).
