Reporting

How to schedule a report to run every second Tuesday of the month?

chaseto
Explorer

I am trying to find out whether a report or search can run every second tuesday of a month. I have checked the presets and time range doesn't have any option and I am thinking, is it possible by cron schedule? Please share your valuable answers here.

Thanks

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I think the answer is that it is not easily possible in crontab on the OS level and I don't think you'll have hence luck with any cron expression within Splunk.
I also think the the solution referenced in the comment above may not work due to crontab's evaluation of day and month specification. It will likely cause the search to run on all listed days AND on Tuesdays, i.e. be a OR vs. an AND evaluation.

Just out of curiosity: What would be the impact if your search runs every Tuesday? If you want to prevent reports being sent out as a result of the search, you may be able to add some SPL magic to your search that determines whether the current day is the second Tuesday of a month and sets a field to true/false. Example (you need to validate this does what it should):

| eval daynumber=strftime(now(),"%d"), weekday=strftime(now(),"%a"), isSecondTuesday=if(weekday=="Tue" AND daynumber>7 AND daynumber<14, "true", "false" )

Wrap it in a macro to not clutter your reporting search and make it reusable. You can then add a custom alert condition, like search isSecondTuesday="true" to your scheduled report and it will not trigger the alert action (i.e. send the email).

chaseto
Explorer

The reason for second tuesday is that ,we do reboots and re run every second tuesday

0 12 8-14 * 3 echo '2nd Wednesday .........does this work

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I don't think so. This would run on the 8,9,10,11,12,13,14, AND on Wednesdays, I think

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

Here is a question that is similar to what you were looking to do.

https://answers.splunk.com/answers/112803/how-to-schedule-search-on-2nd-saturday-of-every-month.html

chaseto
Explorer

I am trying to figure it out but bot able to,can you tell how it is done for every second tuesday?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...