Is it possible to stagger multiple checks in inputs.conf for a single app?

[alekksi]

Hi all,

I have an app that runs a small handful of scripts every 15 seconds. Instead of staggering the execution of these, they all run at the same time and cause single CPU hosts to hit 100% usage for a single second. The CPU usage is in itself not so much of a problem as they can happily cope with this, but it is causing charts to be a bit skewed with the number of spikes present.

Is there any way of staggering these scripts in a way that the load is more balanced?

Cheers!

[yannK]

If you the cron notation for the interval, you can specify when to run them more precisely/

see http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Inputsconf

interval = [<number>|<cron schedule>]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.


example to have a script running every 15 minutes, but starting 2 minutes after the hour.
interval=2,17,32,47 * * * *

see http://en.wikipedia.org/wiki/Cron

[alekksi]

Nah, no luck so far. I don't think the functionality exists. My solution is the same as yours but slightly different notation.

Many thanks anyway -- I'll keep probing!

[yannK]

My bad, I miss read 15 seconds as 15 minutes. I have no idea then.

Is your solution working ?

[alekksi]

interval=2-59/4 * * * * * * would work for that as well

[alekksi]

Thanks but unfortunately cron doesn't do sub-one minute execution. This is running every 15 seconds.