Getting Data In

Is it possible to stagger multiple checks in inputs.conf for a single app?

alekksi
Communicator

Hi all,

I have an app that runs a small handful of scripts every 15 seconds. Instead of staggering the execution of these, they all run at the same time and cause single CPU hosts to hit 100% usage for a single second. The CPU usage is in itself not so much of a problem as they can happily cope with this, but it is causing charts to be a bit skewed with the number of spikes present.

Is there any way of staggering these scripts in a way that the load is more balanced?

Cheers!

Tags (2)

yannK
Splunk Employee
Splunk Employee

If you the cron notation for the interval, you can specify when to run them more precisely/

see http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Inputsconf

interval = [<number>|<cron schedule>]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.

example to have a script running every 15 minutes, but starting 2 minutes after the hour.
interval=2,17,32,47 * * * *

see http://en.wikipedia.org/wiki/Cron

alekksi
Communicator

Nah, no luck so far. I don't think the functionality exists. My solution is the same as yours but slightly different notation.

Many thanks anyway -- I'll keep probing!

0 Karma

yannK
Splunk Employee
Splunk Employee

My bad, I miss read 15 seconds as 15 minutes. I have no idea then.

Is your solution working ?

0 Karma

alekksi
Communicator

interval=2-59/4 * * * * * * would work for that as well

0 Karma

alekksi
Communicator

Thanks but unfortunately cron doesn't do sub-one minute execution. This is running every 15 seconds.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...