How to compute next cron iteration from _raw event?

[cdaviet]

Hi,

I have a last run epoch time and a cron schedule (i.e. : "*/5 * * * *") in an _raw event and I'd like to parse these information to output the next run.

Do you have any idea how to do this?

I found this addon :https://splunkbase.splunk.com/app/4078/ but it does not allow me to use a custom "last run time" and always takes the earliest time of my search as an input.

Thanks 🙂

[gjanders]

Would this cron app work? 

https://splunkbase.splunk.com/app/4027/#/overview you can pass it a start epoch and a cron schedule 

[cdaviet]

I tried it but I've got errors using the command

[isoutamo]

I'm not sure what you are trying, but if you want to schedule the next run 5min after the current has ended then you can just use interval instead of cron expression. Then the next run starts after that interval. It start counting from the end on current/previous run.

r. Ismo

[cdaviet]

No, the cron expression is in the _raw event. I don't have the interval.

[isoutamo]

So you want to get the next run time for that schedule?

[cdaviet]

Yes 🙂