Getting Data In

Is it possible to find when the next scheduled run of a scripted input will occur?


Is it possible to find the time of the next scheduled run of a scripted input from within Splunk?

The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item.

In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule.

I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs.


Tags (1)
0 Karma

Revered Legend

Try this

|rest /services/data/inputs/script | eval nextScheduletime=starttime+interval | table title disabled starttime interval nextScheduletime source sourcetype | convert ctime(*time)
0 Karma


Thanks for the suggestion.

This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...