Skip to main content
Solved

Google SecOps scheduled report last day of month

  • July 14, 2026
  • 1 reply
  • 27 views
Miguel
Forum|alt.badge.img

Hi everyone,

I'm trying to schedule a monthly report in Google SecOps to run on the last day of every month at 11:59 PM (America/Lima timezone).

The report is based on a dashboard whose time range is configured as "Last month".

The problem is that the Advanced Scheduler doesn't seem to support the L character in the CRON expression.

For example:

0 59 23 L * ?

returns:

Cron expression is invalid

The scheduler accepts expressions such as:

0 0 1 * ?

but rejects any expression using L.

The reason I need the report to run on the last day of the month is that if I schedule it on the 1st day of the next month, the dashboard no longer contains the complete data for the previous month because the time filter is relative.

My questions are:

  1. Is there a supported way to schedule a report on the last day of the month in Google SecOps?
  2. Does the scheduler support a different CRON syntax than Quartz?
  3. If this isn't supported, what is the recommended workaround for monthly reports?

Any guidance or best practices would be greatly appreciated.

Thanks!

Best answer by whathehack81

That runs at 00:10 on day 1. Keep the scheduler timezone set to America/Lima.

I would also avoid 23:59 on the final day because the report may exclude the final minute or late-arriving events. Running shortly after midnight provides a small ingestion buffer.

The dashboard filter should ideally represent the previous calendar month, not a rolling 30-day period. If the built-in “Last month” filter does not preserve the full previous month when the report runs on day 1, verify:

The dashboard and scheduler use the same timezone.

“Last month” is a calendar-month filter rather than a rolling interval.

The report is not generated before all prior-month data has finished ingesting.

If an exact last-day trigger is mandatory, the reliable solution is an external scheduler that runs on days 28–31 and only triggers the report when tomorrow is the first day of a new month.

So, based on the behavior shown:

L is not supported by this scheduler.

The syntax is Quartz-like, but not full Quartz.

Scheduling on the first day with a previous-calendar-month filter and a small ingestion delay is the recommended operational workaround.

 

    1 reply

    whathehack81
    Forum|alt.badge.img+4
    • whathehack81Bronze 1
    • Bronze 1
    • Answer
    • July 14, 2026

    That runs at 00:10 on day 1. Keep the scheduler timezone set to America/Lima.

    I would also avoid 23:59 on the final day because the report may exclude the final minute or late-arriving events. Running shortly after midnight provides a small ingestion buffer.

    The dashboard filter should ideally represent the previous calendar month, not a rolling 30-day period. If the built-in “Last month” filter does not preserve the full previous month when the report runs on day 1, verify:

    The dashboard and scheduler use the same timezone.

    “Last month” is a calendar-month filter rather than a rolling interval.

    The report is not generated before all prior-month data has finished ingesting.

    If an exact last-day trigger is mandatory, the reliable solution is an external scheduler that runs on days 28–31 and only triggers the report when tomorrow is the first day of a new month.

    So, based on the behavior shown:

    L is not supported by this scheduler.

    The syntax is Quartz-like, but not full Quartz.

    Scheduling on the first day with a previous-calendar-month filter and a small ingestion delay is the recommended operational workaround.

     

    R.Q whathehack81
      Terms & ConditionsAccessibility statement
      Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

      © 2025 Google. All rights reserved.