topic Re: What's the difference between cron schedule and auto_summarize.cron_schedule? in Alerting

What's the difference between cron schedule and auto_summarize.cron_schedule?

hrithiktej — Tue, 29 Sep 2020 15:19:29 GMT

Please help

I find just 5 stars in cron schedule * * * * * & auto_summarize.cron_schedule is */10 * * * * what is the difference between these two.

I am trying to find the schedule of the alerts that are setup by other users. In Searches, reports, and alerts > advanced edit for one of the search I find just 5 stars in cron schedule * * * * * & auto_summarize.cron_schedule is */10 * * * * what is the difference between these two.

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

cpetterborg — Mon, 14 Aug 2017 17:55:40 GMT

This applies only to the first field: */10 means every ten minutes. */2 means every other minute. */30 means every 30 minutes.

In some cron configurations you can do something like 3/5 and it means start at minute 3 past the hour and run every 5minutes after that.

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

hrithiktej — Tue, 29 Sep 2020 15:19:31 GMT

Thanks for the quick help. I do not understand

1) What do the 5 stars in cron schedule * * * * * mean?

and the auto_summarize.cron_schedule is */10 * * * * does this mean the search is scheduled to run every 10mins?

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

somesoni2 — Tue, 29 Sep 2020 15:21:23 GMT

The format of cron schedule in Splunk is (minute) (hour) (day of month) (month) (day of week). So * * * * * is every minute. The auto_summarize cron_schedule is effective when you've setup Report Acceleration on your search (attribute name auto_summarize =true). If you're accelerating your scheduled search, you can ignore auto_summarize.cron_schedule value.

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

cpetterborg — Mon, 14 Aug 2017 18:24:45 GMT

Crontab Format. Commands are executed by cron when the minute, hour, and month of year fields match the current time, and when at least one of the two day fields (day of month, or day of week) match the current time. A field may be an asterisk ( * ), which always stands for "first-last". Ranges of numbers are allowed.

First field = Minutes
Second field = Hours
Third field = Day of the month
Fourth field = Month
Fifth field = Day of the week

An asterisk basically matches every possible match, so for minutes and asterisk means any minute from 0-59. If you have * * * * *, that means every minute of every hour of every day of every month of the year, no matter what day of the week. to put the minutes field at */10 means every 10 minutes of every hour of every day of every month of the year, no matter what day of the week.

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

hrithiktej — Tue, 29 Sep 2020 15:22:37 GMT

Thanks for the reply I have 5 asterixs * * * * * in the Cron schedule box. Should I ignore the other box which has */10 in the auto_summarize.cron_schedule ?

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

cpetterborg — Wed, 16 Aug 2017 19:09:46 GMT

I would say, yes, ignore it. It is just going to run every 10 minutes instead of every minute. If you need it to run more often, then you can make the 10 be a smaller number or eliminate the /10 altogether.

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

hrithiktej — Wed, 16 Aug 2017 19:12:21 GMT

Thanks for your help

Re: What's the difference between cron schedule and auto_summarize.cron_schedule?

hrithiktej — Wed, 16 Aug 2017 19:12:43 GMT

Thank you very much for your help