topic Splunk forwarder input.conf interval issue in Getting Data In

Splunk forwarder input.conf interval issue

jotase — Thu, 03 Feb 2022 22:32:58 GMT

I have an issue with my splunk forwarder. Inside the inputs.conf, the interval is set to run at 5 9 * * * .

So 09:05 daily if I did it correctly. I restart splunk service as splunk. The job will run ONE time at 09:05.

The only way I can get it to run as scheduled is if I put the interval in as seconds 86400. Does anyone else have that problem?

Re: Splunk forwarder input.conf interval issue

tshah-splunk — Mon, 07 Feb 2022 05:57:34 GMT

Hey @jotase ,

Can you confirm that the cron schedule was defined in proper format as mentioned in the inputs.conf doc:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Scripted_Input:

To specify a cron schedule, use the following format:
  * "<minute> <hour> <day of month> <month> <day of week>"
  * Cron special characters are acceptable. You can use combinations of "*",
  ",", "/", and "-" to specify wildcards, separate values, specify ranges
  of values, and step values.

Re: Splunk forwarder input.conf interval issue

jotase — Mon, 07 Feb 2022 13:02:11 GMT

yes it is in the body of my question "Inside the inputs.conf, the interval is set to run at 5 9 * * * "

5 9 * * *

Re: Splunk forwarder input.conf interval issue

tshah-splunk — Mon, 07 Feb 2022 16:37:10 GMT

Was trying to understand if the schedule was defined within double quotes or not