Getting Data In

Is it possible to find when the next scheduled run of a scripted input will occur?

davebrooking
Contributor

Is it possible to find the time of the next scheduled run of a scripted input from within Splunk?

The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item.

In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule.

I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs.

Dave

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

|rest /services/data/inputs/script | eval nextScheduletime=starttime+interval | table title disabled starttime interval nextScheduletime source sourcetype | convert ctime(*time)
0 Karma

davebrooking
Contributor

Thanks for the suggestion.

This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...