topic Re: How to compute next cron iteration from _raw event in Splunk Search

How to compute next cron iteration from _raw event?

cdaviet — Mon, 14 Feb 2022 18:43:00 GMT

Hi,

I have a last run epoch time and a cron schedule (i.e. : "*/5 * * * *") in an _raw event and I'd like to parse these information to output the next run.

Do you have any idea how to do this?

I found this addon :https://splunkbase.splunk.com/app/4078/ but it does not allow me to use a custom "last run time" and always takes the earliest time of my search as an input.

Thanks 🙂

Re: How to compute next cron iteration from _raw event

isoutamo — Mon, 14 Feb 2022 09:20:39 GMT

I'm not sure what you are trying, but if you want to schedule the next run 5min after the current has ended then you can just use interval instead of cron expression. Then the next run starts after that interval. It start counting from the end on current/previous run.

r. Ismo

Re: How to compute next cron iteration from _raw event

cdaviet — Mon, 14 Feb 2022 09:33:34 GMT

No, the cron expression is in the _raw event. I don't have the interval.

Re: How to compute next cron iteration from _raw event

isoutamo — Mon, 14 Feb 2022 18:54:13 GMT

So you want to get the next run time for that schedule?

Re: How to compute next cron iteration from _raw event?

gjanders — Tue, 15 Feb 2022 05:10:34 GMT

Would this cron app work?

https://splunkbase.splunk.com/app/4027/#/overview you can pass it a start epoch and a cron schedule

Re: How to compute next cron iteration from _raw event

cdaviet — Tue, 15 Feb 2022 07:42:10 GMT

Yes 🙂

Re: How to compute next cron iteration from _raw event?

cdaviet — Tue, 15 Feb 2022 07:42:54 GMT

I tried it but I've got errors using the command