Security
Highlighted

Cron Expression in Splunk

Path Finder

Hi

I want a cron expression to run in everny 4 minutes .When i give */5 * * * * i am getting
com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza ***
Please suggest the reason .

Highlighted

Re: Cron Expression in Splunk

SplunkTrust
SplunkTrust

Hi jimjohn,

is this just a typo or are you really missing the * before the /5?
Also you should provide 5 cron parameters for cron in Splunk. Splunk only makes available five parameters for cron notation, not six. The parameters (* * * * *) correspond to minute hour day month day-of-week. Splunk does not use the 6th parameter for year, common in other forms of cron notation.

For more information see the docs page on schedule

hope this helps ...

cheers, MuS

Highlighted

Re: Cron Expression in Splunk

Path Finder

Hi MuS,

Im getting a similar issue, when i try and use */5 * * * * as the cron expression for a database input i get the error:

Encountered the following error while trying to update: In handler 'dbx-monitors': Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data.

I have tried this on 3 different servers and i get the same error every time. the only way i can get multiple runs in an hour is to use comma delimited notation

0 Karma
Highlighted

Re: Cron Expression in Splunk

SplunkTrust
SplunkTrust

Well, either the docs are wrong or this is a bug. You can file a bug here http://www.splunk.com/r/bugs

@piebob, can you check the docs on this topic please?

cheers, MuS

Highlighted

Re: Cron Expression in Splunk

Splunk Employee
Splunk Employee

i'm asking the docteam to take a look!

Highlighted

Re: Cron Expression in Splunk

Splunk Employee
Splunk Employee

Hi all!
I'm a docs writer here at Splunk and am looking into the issue with our engineering team. I'll let you know if it's a bug or a docs-correction issue!
All best,
frobinson

Highlighted

Re: Cron Expression in Splunk

Splunk Employee
Splunk Employee

There are other posts here that seem related. First one I found:
http://answers.splunk.com/answers/177981/why-am-i-getting-invalid-cron-errors-using-a-cron-1.html

We're working to get to the bottom of what's going on here. More info soon!
🙂
frobinson

Highlighted

Re: Cron Expression in Splunk

Splunk Employee
Splunk Employee

Hi @pacrip and @jimjohn!

According to our engineers, your input looks perfectly valid. It sounds like this could be a bug with the DBX app or an endpoint.

@pacrip, your error message ends with "See splunkd.log for full data." Can you please provide the full "ERROR" output from your splunkd.log? This will help us investigate.

Thanks!
frobinson

Highlighted

Re: Cron Expression in Splunk

Path Finder

An interesting sidenote: one of our splunk SMEs tried using the */5 * * * * notation in the inputs.conf file and the job seems to run successfully...

Here is the error output from entering it in the GUI:

04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RTVP/EMSTopicStatus\r\r\nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\r\n hand.execute(info)\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 528, in execute\r\n if self.requestedAction == ACTIONEDIT: self.handleEdit(confInfo)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 238, in handleEdit\r\n self.handleModification("edit", output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 218, in handleModification\r\n id, props = self.processmodification(id, props, type=type, output=output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\resthandlerdbmon.py", line 95, in process_modification\r\n self.validateConfig(stanza, props)\r\n

(to be continued)

0 Karma
Highlighted

Re: Cron Expression in Splunk

Path Finder

File "F:\Program Files\Splunk\etc\apps\dbx\bin\resthandlerdbmon.py", line 126, in validateConfig\r\n executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\java\bridge.py", line 182, in executeBridgeCommand\r\n raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\r\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\r\n\r\n 04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data.

0 Karma