Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

[danielrusso1]

I'm trying to stagger my scheduled searches in order to spread out resource utilization (20% of searches on the hour, 20% 1 minute after, 20% two minutes after etc.).

I should be able to use cron to accomplish this. There is even an existing Answer that addresses this:

http://answers.splunk.com/answers/118757/scheduling-alerts-via-cron.html

However, I get an "Invalid cron" error when attempting to user the following notation:

*/5 * * * *
1-59/5 * * * *
2-59/5 * * * *
3-59/56 * * * *
4-59/5 * * * *

This should work as well, it is a valid expression, but I get the same Splunk error:

*/5
1/5
2/5
3/5
4/5

What should I do here?

[danielrusso1 · Accepted solution]

obviously 🙂

Looks like there could be a bug:

http://answers.splunk.com/answers/139412/scheduling-report-error.html

a212830 gravatar imagea212830 · Jun 10 at 01:07 PM
Turned out to be a bug - you can enter the cron entry via searches-reports and it will work.

I'm finding this work-around works.

[martin_mueller]

What view are you using exactly that throws up the error?

[danielrusso1]

Alerts view does not work. Searches, reports, and alerts view does.

[martin_mueller]

I see, sounds like the alerts view had a more stringent validation built-in. That seems to be fixed in 6.2.0 🙂

[danielrusso1]

hoping to move to the cloud shortly, that should do it!

[martin_mueller]

Great... does that solve this?

[danielrusso1]

Well, the work-around looks like it's working, but the bug still exists, and it is inconvenient.

[martin_mueller]

My Splunk seems to accept 1-59/5 * * * *, says it's next scheduled at 51 past the hour.

[martin_mueller]

6.2.0, obviously 🙂

The answers URL you posted pre-dates 6.1 though, so it should work on 6.1.3 as well.

[danielrusso1]

What version are you on? I am on 6.1.3