I'm trying to schedule a particular alert to run on the first Monday of each fiscal quarter using this cron expression:
0 9 1-7 2,5,8,11 1
My reading of this is "9:00am on the first Monday of Feb, May, Aug, and Nov".
However, with this month being November (11) for some reason it is running it every Monday. It unexpectedly ran this past Mon Nov 16th and has a "next scheduled time" of Mon Nov 23rd. Given the day-of-month restriction (3rd field) of 1-7 I would not have expected this to happen.
Any advice appreciated. Splunk Enterprise 8.0.6. Thanks.