Getting Data In

Is it possible to find when the next scheduled run of a scripted input will occur?

davebrooking
Contributor

Is it possible to find the time of the next scheduled run of a scripted input from within Splunk?

The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item.

In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule.

I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs.

Dave

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this

|rest /services/data/inputs/script | eval nextScheduletime=starttime+interval | table title disabled starttime interval nextScheduletime source sourcetype | convert ctime(*time)
0 Karma

davebrooking
Contributor

Thanks for the suggestion.

This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!