topic Re: Scripted Input Cron Schedule not working correctly in Getting Data In

Scripted Input Cron Schedule not working correctly

aknsun — Fri, 12 Jul 2019 03:59:37 GMT

I have the following inputs.conf for a scripted input. However this is not working as per what I thought it would. The first 2 scripts don't execute and the 3rd one, though it's scheduled to run at 00:30, runs at 00:05 which is basically the time set for the 1st script. Not sure what's happening. Didn't find any errors in _interanal.

[script:///]
disabled = 0
index = someindex
interval = 5 0 * * *
sourcetype = somesourcetype

[script:///]
disabled = 0
index = someindex
interval = 15 0 * * *
sourcetype = somesourcetype

[script:///]
disabled = 0
index = someindex
interval = 30 0 * * *
sourcetype = somesourcetype

Re: Scripted Input Cron Schedule not working correctly

natalienguyen — Fri, 12 Jul 2019 04:35:13 GMT

Hi,

Are the times on the machine you're running the scripts set to the correct time?

Re: Scripted Input Cron Schedule not working correctly

aknsun — Fri, 12 Jul 2019 04:49:30 GMT

Yes, it's set to the correct time.

Re: Scripted Input Cron Schedule not working correctly

aknsun — Fri, 12 Jul 2019 04:56:55 GMT

Looks like it's removing the final 2 "*" in my interval setting.

And I'm using https://crontab.guru.

Re: Scripted Input Cron Schedule not working correctly

burwell — Fri, 12 Jul 2019 05:49:35 GMT

Hi.

It looks like interval should just be number of seconds. Looks like you were trying to use a cron syntax.

https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ScriptSetup

For example from the docs

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/starter_script.sh]
disabled = true # change to false to start the input, requires restart
host = # enter hostname here
index = main
interval = 30    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data

Re: Scripted Input Cron Schedule not working correctly

aknsun — Mon, 22 Jul 2019 06:58:18 GMT

There is an option to use Cron. However, as I found out, it wasn't very reliable. Reverted back to using "interval = seconds "