Cron format for inputs.conf


Does anyone know what the cron format is for "interval" parameter within inputs.conf. Is it the traditional "m h d mon wd"?

Splunk Employee
Splunk Employee

Remember that the interval value means when to "check if the script is still running". If it is not running it will re-launch it. If it is running, it will do nothing.


CRON accepts 5 fields separated by a space these fields should appear in the order minute hour day-of-month month day-of-week

each of this fields can contain a number, range of numbers or the * wildcard The numbers can be zero padded so 05 = 5 and
A range can be identified with a dash or comma such as 1,3,5,7-9,12 You can also use */n to say every n for example */5 in the first column means every 5 minutes.

So if you want a scripted input to run every day at 9:05 am you would put. 5 9 * * *

If you want it to run at five past the hour between 8 and 12 and again at 16:05 you could put 5 8-12,16 * * *

Or every 10 minutes but only in March */10 * * 3 *

Search for cron in google for more details and examples.

Super Champion

Remember that using the cron format in the interval field was a new feature in Splunk 4.1. So before that, interval only supported an integer value representing seconds.

0 Karma

Splunk Employee
Splunk Employee

Yes, it is the standard cron format.