Reporting

Monthly Saved Search For Previous Month

peasead
Path Finder

I'd like to create a saved search that run monthly for the previous month. I know how to do that in the Search app, but when creating a saved search, I don't see those options.

I am going to try and schedule cron 0 0 1 * * and fill the Start Time with "-1mon@mon" and the End Time with "@mon".

Is that going to work?

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it

10 0 1 * *

So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.

The start and end time look correct.

View solution in original post

lguinn2
Legend

Yes, just run the search in the Search app, and then save it as a scheduled search. Your cron schedule will have the search run at 00:00 on the first day of each month; that seems okay, although I would make it

10 0 1 * *

So that it runs at 10 minutes past midnight. That way, any data that was enroute from the forwarders will arrive and be indexed before the search runs.

The start and end time look correct.

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...