When I click on the link for https://crontab.guru/#00_12_1,2,3,4,5,6,7_*_0 the next run date is at 2022-10-23 12:00:00 which is not the first Sunday Nov 6th 2022. I did some digging and found if you use the following: 00 12 1-7 * */7 (https://crontab.guru/#00_12_1-7_*_*/7) in crontab it appears to be what you are looking for. However when I attempt to use that cron in a Splunk schedule it does not work. It appears that Splunk is not like the every 7th day trick */7. Reviewing Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/CronExpressions It appears the only values that can be used are 0-6. Not sure if at this time if there is a way to run on the first Sunday of the month with cron in Splunk. travis
... View more