Hi all,
I may be missing something here and I apologize but I have searched quite a bit.
I want my inputs.conf to check for active sessions every 30 minutes. ideally on the hour and half hour.
If I set interval = */30 * * * *
I believe that should do it. however when I do this, it sends results every 10 seconds.
where as if I set interval = 1800
It does every 30 minutes, just not on the times I would like.
Here is the stanza.
[perfmon://Terminal Services]
counters = Total Sessions; Active Sessions; Inactive Sessions;
disabled = 0
index = perfmon
object = Terminal Services
interval = 1800
showZeroValue = 1
Thank you,
Joshua
Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.
Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.
Try 0,30 * * * *
.
Hey Thanks for the response.
Still, inputs.conf seems to ignore the cron and sends every 10 seconds.
Are you restarting Splunk after editing the file?
After redeploying the app to the forwarders I have Restart Splunk checked. I have not been restarting the search head/indexer. Should I be?
Ah, it's been a long day it just dawned on me that you're trying to use cron for something other than a scripted input. I've never seen it done for a perfmon input. If the manual implies it's possible then you should contact support.
You are right. it does not say it works for perfmon. Thank you.