Cron for Interval not working in inputs.conf where a digit amount is

[joshuayourth]

Hi all,

I may be missing something here and I apologize but I have searched quite a bit.

I want my inputs.conf to check for active sessions every 30 minutes. ideally on the hour and half hour.

If I set interval = */30 * * * *
I believe that should do it. however when I do this, it sends results every 10 seconds.
where as if I set interval = 1800
It does every 30 minutes, just not on the times I would like.
Here is the stanza.

[perfmon://Terminal Services]
counters = Total Sessions; Active Sessions; Inactive Sessions;
disabled = 0
index = perfmon
object = Terminal Services
interval = 1800
showZeroValue = 1

Thank you,

Joshua

[joshuayourth · Accepted solution]

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

[richgalloway]

Try 0,30 * * * *.

[joshuayourth]

Hey Thanks for the response.

Still, inputs.conf seems to ignore the cron and sends every 10 seconds.

[richgalloway]

Are you restarting Splunk after editing the file?

[joshuayourth]

After redeploying the app to the forwarders I have Restart Splunk checked. I have not been restarting the search head/indexer. Should I be?

[richgalloway]

Ah, it's been a long day it just dawned on me that you're trying to use cron for something other than a scripted input. I've never seen it done for a perfmon input. If the manual implies it's possible then you should contact support.

[joshuayourth]

You are right. it does not say it works for perfmon. Thank you.