I have an issue with my splunk forwarder. Inside the inputs.conf, the interval is set to run at 5 9 * * * .
So 09:05 daily if I did it correctly. I restart splunk service as splunk. The job will run ONE time at 09:05.
The only way I can get it to run as scheduled is if I put the interval in as seconds 86400. Does anyone else have that problem?
Was trying to understand if the schedule was defined within double quotes or not
Hey @jotase ,
Can you confirm that the cron schedule was defined in proper format as mentioned in the inputs.conf doc:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#Scripted_Input:
To specify a cron schedule, use the following format: * "<minute> <hour> <day of month> <month> <day of week>" * Cron special characters are acceptable. You can use combinations of "*", ",", "/", and "-" to specify wildcards, separate values, specify ranges of values, and step values.
yes it is in the body of my question "Inside the inputs.conf, the interval is set to run at 5 9 * * * "
5 9 * * *