Getting Data In

Is it possible to find when the next scheduled run of a scripted input will occur?

davebrooking
Contributor

Is it possible to find the time of the next scheduled run of a scripted input from within Splunk?

The Searches, reports and alerts in Settings has a column for Scheduled time, which appears to be the time of the next execution of the item.

In the S.o.S app the Data Inputs Overview dashboard there are fields for endtime and interval when you select a specific input, and using these I could calculate the next scheduled run time. Similarly the endtime and interval fields are available with the REST API data/inputs/script. The calculation is quite simple when the interval is a number of seconds but is more difficult when the interval is provided as a cron schedule.

I was looking for a solution that returned something like the Scheduled time field from the Searches, reports and alerts screen but for scripted inputs.

Dave

Tags (1)
0 Karma

somesoni2
Revered Legend

Try this

|rest /services/data/inputs/script | eval nextScheduletime=starttime+interval | table title disabled starttime interval nextScheduletime source sourcetype | convert ctime(*time)
0 Karma

davebrooking
Contributor

Thanks for the suggestion.

This works as expected when the interval is a number of seconds, but doesn't work if the interval is a cron schedule e.g. * 1 * * * . I tested in a 6.1.1 Splunk instance.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...