Saved Search Cron Error?

[stevensa]

Hey Everyone,

Thanks for taking the time to help!

I have a series of saved searches that are supposed to be running every three minutes after 1am Tuesday-Saturday to report for previous day information:

0 1 * * 2-6
3 1 * * 2-6
6 1 * * 2-6
9 1 * * 2-6
etc...

However, these searches are not running on Saturdays. They run fine Tuesday-Friday but then do not run on Saturday. Can anyone point me in the right direction for what I am doing wrong? Really appreciate your help!

Adam

[yannK]

You cron seems correct

Can you try to list the days 0 1 * * 2,3,4,5,6

Remark: there is no 6th parameter for year in splunk.

[yannK]

I confirm, there is no year in the splnuk cron notation. (I edited my answer)

[stevensa]

Yannk,
Thank you for your response! Splunk does not like the addition of the final star (Currently using 4.1.7, with the 4.2 ugprade expected in a few weeks!). However, I will try explicitly listing the days and report on that Monday.
Thanks again for the suggestion!

Adam