Getting Data In

Cron for Interval not working in inputs.conf where a digit amount is

joshuayourth
Explorer

Hi all,

I may be missing something here and I apologize but I have searched quite a bit.

I want my inputs.conf to check for active sessions every 30 minutes. ideally on the hour and half hour.

If I set interval = */30 * * * *
I believe that should do it. however when I do this, it sends results every 10 seconds.
where as if I set interval = 1800
It does every 30 minutes, just not on the times I would like.
Here is the stanza.

[perfmon://Terminal Services]
counters = Total Sessions; Active Sessions; Inactive Sessions;
disabled = 0
index = perfmon
object = Terminal Services
interval = 1800
showZeroValue = 1

Thank you,

Joshua

0 Karma
1 Solution

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

View solution in original post

0 Karma

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 0,30 * * * *.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

Hey Thanks for the response.

Still, inputs.conf seems to ignore the cron and sends every 10 seconds.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you restarting Splunk after editing the file?

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

After redeploying the app to the forwarders I have Restart Splunk checked. I have not been restarting the search head/indexer. Should I be?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah, it's been a long day it just dawned on me that you're trying to use cron for something other than a scripted input. I've never seen it done for a perfmon input. If the manual implies it's possible then you should contact support.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

You are right. it does not say it works for perfmon. Thank you.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...