Getting Data In

WMI.Conf - Doesn't support Cron time?

Drainy
Champion

Hi,

So I have been doing some scripted input for WMI data and have discovered that Splunk has this functionality already built in (so I don't need to use scripts to access WMI data).
However, I assumed that the "interval" parameter would accept cron time as this is how it functions across other conf files.

It appears that isn't the case as my cron for taking data at 6,11 and 16:00 hours was interpreted as every second (The cron statement was = 0 6,11,16 * * *). The statement was a copy and paste from inputs.conf where I had the input scripted.
Is this a bug / oversight or is WMI.Conf deliberately designed to not use cron functionality?

I have been using the above on SplunkUniversalForwarders on remote machines to collect and forward the WMI data.

Thanks for any help

Tags (3)

mixolydian
Path Finder

The cron statement you provided is missing the month and day of week. Probably just a typo, but I figured I'd comment just in case it was relevant.

0 Karma

gavsdavs_GR
Path Finder

So wmi.conf doesn't yet support cron style notation for the "interval" parameter so i am stuck with specifying an interval in seconds.

I'd like to run my inputs just once a day, not once per restart or 86400 seconds..

When is this going to be implemented ?

0 Karma

Drainy
Champion

Oh wow, I'd completely forgotten about this question! Yeah the cron statement will still function if you drop off values. WMI.conf just doesn't support it atm, I think this ended up as an ER somewhere 🙂 Thanks though!

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...