https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126744#M26101 <P>Nah, no luck so far. I don't think the functionality exists. My solution is the same as yours but slightly different notation.</P> <P>Many thanks anyway -- I'll keep probing!</P> Wed, 02 Jul 2014 15:06:13 GMT alekksi 2014-07-02T15:06:13Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126739#M26096 <P>Hi all,</P> <P>I have an app that runs a small handful of scripts every 15 seconds. Instead of staggering the execution of these, they all run at the same time and cause single CPU hosts to hit 100% usage for a single second. The CPU usage is in itself not so much of a problem as they can happily cope with this, but it is causing charts to be a bit skewed with the number of spikes present.</P> <P>Is there any way of staggering these scripts in a way that the load is more balanced?</P> <P>Cheers!</P> Tue, 01 Jul 2014 15:40:51 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126739#M26096 alekksi 2014-07-01T15:40:51Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126740#M26097 <P>If you the cron notation for the interval, you can specify when to run them more precisely/</P> <P>see <A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Inputsconf</A></P> <P><CODE>interval = [&lt;number&gt;|&lt;cron schedule&gt;]<BR /> * How often to execute the specified command (in seconds), or a valid cron schedule. <BR /> * NOTE: when a cron schedule is specified, the script is not executed on start-up.<BR /> </CODE></P> <P>example to have a script running every 15 minutes, but starting 2 minutes after the hour.<BR /> <CODE>interval=2,17,32,47 * * * *</CODE></P> <P>see <A href="http://en.wikipedia.org/wiki/Cron">http://en.wikipedia.org/wiki/Cron</A></P> Tue, 01 Jul 2014 16:10:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126740#M26097 yannK 2014-07-01T16:10:59Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126741#M26098 <P>Thanks but unfortunately cron doesn't do sub-one minute execution. This is running every 15 seconds.</P> Tue, 01 Jul 2014 16:20:33 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126741#M26098 alekksi 2014-07-01T16:20:33Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126742#M26099 <P>interval=2-59/4 * * * * * * would work for that as well</P> Tue, 01 Jul 2014 16:25:06 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126742#M26099 alekksi 2014-07-01T16:25:06Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126743#M26100 <P>My bad, I miss read 15 seconds as 15 minutes. I have no idea then.</P> <P>Is your solution working ?</P> Tue, 01 Jul 2014 16:37:30 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126743#M26100 yannK 2014-07-01T16:37:30Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126744#M26101 <P>Nah, no luck so far. I don't think the functionality exists. My solution is the same as yours but slightly different notation.</P> <P>Many thanks anyway -- I'll keep probing!</P> Wed, 02 Jul 2014 15:06:13 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-stagger-multiple-checks-in-inputs-conf-for-a/m-p/126744#M26101 alekksi 2014-07-02T15:06:13Z