topic cron in decimal in Splunk Search

cron in decimal

aniketb — Mon, 25 Nov 2013 16:21:05 GMT

I use Splunk 5.0.1

I want a scheduled search to run by 2.5 hours. Does the search accept decimal values?

like from:

-2.5h@h to now

cron: 0 */2.5 * * *

Re: cron in decimal

gfuente — Mon, 25 Nov 2013 16:24:10 GMT

Hello

I think you can use this schedule

150m

To run the query every 150 minutes

regards

Re: cron in decimal

aniketb — Mon, 25 Nov 2013 17:02:15 GMT

-150m may be good to search for records in last 2.5 hours but it does not satisfy cron criteria. I need the search to run every 2.5 hours and when i try this it throws an error.

Encountered the following error while trying to update: In handler 'savedsearch': Invalid cron_schedule="*/150 * * * *"

Re: cron in decimal

linu1988 — Mon, 25 Nov 2013 17:28:33 GMT

No it doesn't take decimal value in cron schedule.

Re: cron in decimal

lukejadamec — Mon, 25 Nov 2013 17:52:06 GMT

According to stackoverflow you cannot do it in a single statement. The recommendation is to use two statements:

0 */5 * * *

and

30 2,7,12,17,22 * * *

See the post:

http://stackoverflow.com/questions/13226003/how-to-execute-a-cron-expression-for-every-2-5-hours

Re: cron in decimal

aniketb — Mon, 25 Nov 2013 19:04:43 GMT

Hey luke, I do want to try your method but we are allowed just one statement in cron in splunk 😞

Re: cron in decimal

lukejadamec — Mon, 25 Nov 2013 19:08:50 GMT

Well, I expected you would create two scheduled searches - one with one cron schedule, and one with the other. Splunk won't really care.