Getting Data In

Is it possible to stagger multiple checks in inputs.conf for a single app?

alekksi
Communicator

Hi all,

I have an app that runs a small handful of scripts every 15 seconds. Instead of staggering the execution of these, they all run at the same time and cause single CPU hosts to hit 100% usage for a single second. The CPU usage is in itself not so much of a problem as they can happily cope with this, but it is causing charts to be a bit skewed with the number of spikes present.

Is there any way of staggering these scripts in a way that the load is more balanced?

Cheers!

Tags (2)

yannK
Splunk Employee
Splunk Employee

If you the cron notation for the interval, you can specify when to run them more precisely/

see http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Inputsconf

interval = [<number>|<cron schedule>]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.

example to have a script running every 15 minutes, but starting 2 minutes after the hour.
interval=2,17,32,47 * * * *

see http://en.wikipedia.org/wiki/Cron

alekksi
Communicator

Nah, no luck so far. I don't think the functionality exists. My solution is the same as yours but slightly different notation.

Many thanks anyway -- I'll keep probing!

0 Karma

yannK
Splunk Employee
Splunk Employee

My bad, I miss read 15 seconds as 15 minutes. I have no idea then.

Is your solution working ?

0 Karma

alekksi
Communicator

interval=2-59/4 * * * * * * would work for that as well

0 Karma

alekksi
Communicator

Thanks but unfortunately cron doesn't do sub-one minute execution. This is running every 15 seconds.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...