Splunk forwarder input.conf interval issue

[jotase]

I have an issue with my splunk forwarder.  Inside the inputs.conf, the interval is set to run at 5 9 * * * .

So 09:05 daily if I did it correctly.  I restart splunk service as splunk.  The job will run ONE time at 09:05.

The only way I can get it to run as scheduled is if I put the interval in as seconds 86400.  Does anyone else have that problem?

[tshah-splunk]

Was trying to understand if the schedule was defined within double quotes or not

[tshah-splunk]

Hey @jotase ,

Can you confirm that the cron schedule was defined in proper format as mentioned in the inputs.conf doc:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Scripted_Input: 

To specify a cron schedule, use the following format:
  * "<minute> <hour> <day of month> <month> <day of week>"
  * Cron special characters are acceptable. You can use combinations of "*",
  ",", "/", and "-" to specify wildcards, separate values, specify ranges
  of values, and step values.

[jotase]

yes it is in the body of my question "Inside the inputs.conf, the interval is set to run at 5 9 * * * " 

5 9 * * *