Reporting

How to edit my cron expression to run a Scheduled Report on data for the previous weekday (not Saturday or Sunday)?

Stuarth09
Explorer

I've got a report that I want to schedule to run in the early morning and process and present a bunch of data from the previous day. So, run at 6AM on a Tuesday morning to gather all of Monday's data and display that until Wednesday morning. I don't want to display the data for Saturday and Sunday - on Monday. I want to see Friday's data.

My date range is set to "yesterday" on my report and that seems to be working fine. But I'm using the following cron expression: 0 6 * * 2-6 and it seems to only run Tuesday-Friday, not Tuesday-Saturday as I expected. On Monday I see Thursday's data (which I had already seen on Friday), instead of Friday's, and all of the other days are correct. Is there some reason my cron expression isn't causing the search to run on Saturday morning?

0 Karma

JDukeSplunk
Builder

You could use the time functions in the search itself and just cron it for the same time every day.

| where Date > case(strftime(now(),"%w")="1", relative_time(now(), "-3d@d"), strftime(now(),"%w")!="1", relative_time(now(), "-1d@d"))

I grabbed this little bit of code from here.
https://answers.splunk.com/answers/136802/function-to-return-last-weekday.html

0 Karma

somesoni2
Revered Legend

The cron looks good to me (reference http://crontab.guru/#0_6_*_*_2-6). How are you getting the report content, email? If yes for email, then when you say on Mon you see data for Thu, does that mean you get another email on Sat which still showing data for Thu?

0 Karma

Stuarth09
Explorer

I'm displaying the data in a dashboard that's relying on the scheduled report. So if I look on Tuesday, I see Monday's data, as intended. I also see Thursday's data on Friday, as intended. But on Monday I see Thursday's data, when I would have expected to see Friday's.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...