Scripted Input Cron Schedule not working correctly

[aknsun]

I have the following inputs.conf for a scripted input. However this is not working as per what I thought it would. The first 2 scripts don't execute and the 3rd one, though it's scheduled to run at 00:30, runs at 00:05 which is basically the time set for the 1st script. Not sure what's happening. Didn't find any errors in _interanal.

[script:///]
disabled = 0
index = someindex
interval = 5 0 * * *
sourcetype = somesourcetype

[script:///]
disabled = 0
index = someindex
interval = 15 0 * * *
sourcetype = somesourcetype

[script:///]
disabled = 0
index = someindex
interval = 30 0 * * *
sourcetype = somesourcetype

[burwell · Accepted solution]

Hi.

It looks like interval should just be number of seconds. Looks like you were trying to use a cron syntax.

https://docs.splunk.com/Documentation/Splunk/7.3.0/AdvancedDev/ScriptSetup

For example from the docs

[script://$SPLUNK_HOME/etc/apps/<appName>/bin/starter_script.sh]
disabled = true # change to false to start the input, requires restart
host = # enter hostname here
index = main
interval = 30    #frequency to run the script, in seconds
source = my_db
sourcetype = my_db_data

[aknsun]

There is an option to use Cron. However, as I found out, it wasn't very reliable. Reverted back to using "interval = seconds "

[aknsun]

Looks like it's removing the final 2 "*" in my interval setting.

And I'm using https://crontab.guru.

[natalienguyen]

Hi,

Are the times on the machine you're running the scripts set to the correct time?

[aknsun]

Yes, it's set to the correct time.