Getting Data In

Cron for Interval not working in inputs.conf where a digit amount is

joshuayourth
Explorer

Hi all,

I may be missing something here and I apologize but I have searched quite a bit.

I want my inputs.conf to check for active sessions every 30 minutes. ideally on the hour and half hour.

If I set interval = */30 * * * *
I believe that should do it. however when I do this, it sends results every 10 seconds.
where as if I set interval = 1800
It does every 30 minutes, just not on the times I would like.
Here is the stanza.

[perfmon://Terminal Services]
counters = Total Sessions; Active Sessions; Inactive Sessions;
disabled = 0
index = perfmon
object = Terminal Services
interval = 1800
showZeroValue = 1

Thank you,

Joshua

0 Karma
1 Solution

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

View solution in original post

0 Karma

joshuayourth
Explorer

Thanks to @richgalloway, I've realized that cron works for scripted inputs but it is not supported for perfmon.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try 0,30 * * * *.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

Hey Thanks for the response.

Still, inputs.conf seems to ignore the cron and sends every 10 seconds.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you restarting Splunk after editing the file?

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

After redeploying the app to the forwarders I have Restart Splunk checked. I have not been restarting the search head/indexer. Should I be?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Ah, it's been a long day it just dawned on me that you're trying to use cron for something other than a scripted input. I've never seen it done for a perfmon input. If the manual implies it's possible then you should contact support.

---
If this reply helps you, Karma would be appreciated.
0 Karma

joshuayourth
Explorer

You are right. it does not say it works for perfmon. Thank you.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...