Getting Data In

Cron for Interval not working in inputs.conf where a digit amount is

joshuayourth
Explorer

Hi all,

I may be missing something here and I apologize but I have searched quite a bit.

I want my inputs.conf to check for active sessions every 30 minutes. ideally on the hour and half hour.

If I set interval = */30 * * * *
I believe that should do it. however when I do this, it sends results every 10 seconds.
where as if I set interval = 1800
It does every 30 minutes, just not on the times I would like.
Here is the stanza.

[perfmon://Terminal Services]
counters = Total Sessions; Active Sessions; Inactive Sessions;
disabled = 0
index = perfmon
object = Terminal Services
interval = 1800
showZeroValue = 1

Thank you,

Joshua

0 Karma
1 Solution

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

View solution in original post

0 Karma

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 0,30 * * * *.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

Hey Thanks for the response.

Still, inputs.conf seems to ignore the cron and sends every 10 seconds.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you restarting Splunk after editing the file?

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

After redeploying the app to the forwarders I have Restart Splunk checked. I have not been restarting the search head/indexer. Should I be?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah, it's been a long day it just dawned on me that you're trying to use cron for something other than a scripted input. I've never seen it done for a perfmon input. If the manual implies it's possible then you should contact support.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

You are right. it does not say it works for perfmon. Thank you.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...