topic Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3? in Reporting

Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Wed, 29 Oct 2014 20:37:03 GMT

I'm trying to stagger my scheduled searches in order to spread out resource utilization (20% of searches on the hour, 20% 1 minute after, 20% two minutes after etc.).

I should be able to use cron to accomplish this. There is even an existing Answer that addresses this:

http://answers.splunk.com/answers/118757/scheduling-alerts-via-cron.html

However, I get an "Invalid cron" error when attempting to user the following notation:

*/5 * * * *
1-59/5 * * * *
2-59/5 * * * *
3-59/56 * * * *
4-59/5 * * * *

This should work as well, it is a valid expression, but I get the same Splunk error:

*/5
1/5
2/5
3/5
4/5

What should I do here?

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

martin_mueller — Wed, 29 Oct 2014 20:49:11 GMT

My Splunk seems to accept 1-59/5 * * * *, says it's next scheduled at 51 past the hour.

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Wed, 29 Oct 2014 20:55:04 GMT

What version are you on? I am on 6.1.3

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

martin_mueller — Wed, 29 Oct 2014 21:00:06 GMT

6.2.0, obviously 🙂

The answers URL you posted pre-dates 6.1 though, so it should work on 6.1.3 as well.

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Wed, 29 Oct 2014 21:08:17 GMT

obviously 🙂

Looks like there could be a bug:

http://answers.splunk.com/answers/139412/scheduling-report-error.html

a212830 gravatar imagea212830 · Jun 10 at 01:07 PM
Turned out to be a bug - you can enter the cron entry via searches-reports and it will work.

I'm finding this work-around works.

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

martin_mueller — Wed, 29 Oct 2014 21:40:45 GMT

Great... does that solve this?

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Thu, 30 Oct 2014 13:06:48 GMT

Well, the work-around looks like it's working, but the bug still exists, and it is inconvenient.

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

martin_mueller — Thu, 30 Oct 2014 13:09:27 GMT

What view are you using exactly that throws up the error?

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Fri, 31 Oct 2014 17:11:35 GMT

Alerts view does not work. Searches, reports, and alerts view does.

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

martin_mueller — Fri, 31 Oct 2014 17:16:53 GMT

I see, sounds like the alerts view had a more stringent validation built-in. That seems to be fixed in 6.2.0 🙂

Re: Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1 — Fri, 31 Oct 2014 18:47:28 GMT

hoping to move to the cloud shortly, that should do it!