Is it possible to find when the next scheduled run of a scripted input will occur?

[davebrooking]

Is it possible to find the time of the next scheduled run of a scripted input from within Splunk?

The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item.

In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule.

I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs.

Dave

[somesoni2]

Try this

|rest /services/data/inputs/script | eval nextScheduletime=starttime+interval | table title disabled starttime interval nextScheduletime source sourcetype | convert ctime(*time)

[davebrooking]

Thanks for the suggestion.

This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.