Hey Everyone,
Thanks for taking the time to help!
I have a series of saved searches that are supposed to be running every three minutes after 1am Tuesday-Saturday to report for previous day information:
0 1 * * 2-6
3 1 * * 2-6
6 1 * * 2-6
9 1 * * 2-6
etc...
However, these searches are not running on Saturdays. They run fine Tuesday-Friday but then do not run on Saturday. Can anyone point me in the right direction for what I am doing wrong? Really appreciate your help!
Adam
You cron seems correct
Can you try to list the days 0 1 * * 2,3,4,5,6
Remark: there is no 6th parameter for year in splunk.
I confirm, there is no year in the splnuk cron notation. (I edited my answer)
Yannk,
Thank you for your response! Splunk does not like the addition of the final star (Currently using 4.1.7, with the 4.2 ugprade expected in a few weeks!). However, I will try explicitly listing the days and report on that Monday.
Thanks again for the suggestion!
Adam