Reporting

Why am I getting "invalid cron" errors using a cron schedule to stagger scheduled searches in Splunk 6.1.3?

danielrusso1
Path Finder

I'm trying to stagger my scheduled searches in order to spread out resource utilization (20% of searches on the hour, 20% 1 minute after, 20% two minutes after etc.).

I should be able to use cron to accomplish this. There is even an existing Answer that addresses this:

http://answers.splunk.com/answers/118757/scheduling-alerts-via-cron.html

However, I get an "Invalid cron" error when attempting to user the following notation:

*/5 * * * *
1-59/5 * * * *
2-59/5 * * * *
3-59/56 * * * *
4-59/5 * * * *

This should work as well, it is a valid expression, but I get the same Splunk error:

*/5
1/5
2/5
3/5
4/5

What should I do here?

1 Solution

danielrusso1
Path Finder

obviously 🙂

Looks like there could be a bug:

http://answers.splunk.com/answers/139412/scheduling-report-error.html

a212830 gravatar imagea212830 · Jun 10 at 01:07 PM
Turned out to be a bug - you can enter the cron entry via searches-reports and it will work.

I'm finding this work-around works.

View solution in original post

danielrusso1
Path Finder

obviously 🙂

Looks like there could be a bug:

http://answers.splunk.com/answers/139412/scheduling-report-error.html

a212830 gravatar imagea212830 · Jun 10 at 01:07 PM
Turned out to be a bug - you can enter the cron entry via searches-reports and it will work.

I'm finding this work-around works.

martin_mueller
SplunkTrust
SplunkTrust

What view are you using exactly that throws up the error?

0 Karma

danielrusso1
Path Finder

Alerts view does not work. Searches, reports, and alerts view does.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see, sounds like the alerts view had a more stringent validation built-in. That seems to be fixed in 6.2.0 🙂

0 Karma

danielrusso1
Path Finder

hoping to move to the cloud shortly, that should do it!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Great... does that solve this?

0 Karma

danielrusso1
Path Finder

Well, the work-around looks like it's working, but the bug still exists, and it is inconvenient.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

My Splunk seems to accept 1-59/5 * * * *, says it's next scheduled at 51 past the hour.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

6.2.0, obviously 🙂

The answers URL you posted pre-dates 6.1 though, so it should work on 6.1.3 as well.

0 Karma

danielrusso1
Path Finder

What version are you on? I am on 6.1.3

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...