Cron Expression in Splunk

[jimjohn]

Hi

I want a cron expression to run in everny 4 minutes .When i give */5 * * * * i am getting
com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza ***
Please suggest the reason .

[bohrasaurabh]

This is specific to DBX and we have noticed the same issue on DBX release 1.15

[frobinson_splun]

@bohrasaurabh, thanks for your feedback. Please see my comment below about cron expression parsing. I'll look into the issue you're seeing a bit more. It sounds like a bug. I'll report back with an update.
Thanks and feel free to ask further questions!

[MuS]

Hi jimjohn,

is this just a typo or are you really missing the * before the /5?
Also you should provide 5 cron parameters for cron in Splunk. Splunk only makes available five parameters for cron notation, not six. The parameters (* * * * *) correspond to minute hour day month day-of-week. Splunk does not use the 6th parameter for year, common in other forms of cron notation.

For more information see the docs page on schedule

hope this helps ...

cheers, MuS

[pacrip]

Hi MuS,

Im getting a similar issue, when i try and use */5 * * * * as the cron expression for a database input i get the error:

Encountered the following error while trying to update: In handler 'dbx-monitors': Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data.

I have tried this on 3 different servers and i get the same error every time. the only way i can get multiple runs in an hour is to use comma delimited notation

[frobinson_splun]

Hi @pacrip and @jimjohn!

According to our engineers, your input looks perfectly valid. It sounds like this could be a bug with the DBX app or an endpoint.

@pacrip, your error message ends with "See splunkd.log for full data." Can you please provide the full "ERROR" output from your splunkd.log? This will help us investigate.

Thanks!
frobinson

[pacrip]

An interesting sidenote: one of our splunk SMEs tried using the */5 * * * * notation in the inputs.conf file and the job seems to run successfully...

Here is the error output from entering it in the GUI:

04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Received malformed XML from external handler:\nFailed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RTVP/EMSTopicStatus\r\r\nfalse<class 'spp.java.bridge.JavaBridgeError'>Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17Traceback (most recent call last):\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 70, in init\r\n hand.execute(info)\r\n File "F:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\admin.py", line 528, in execute\r\n if self.requestedAction == ACTION_EDIT: self.handleEdit(confInfo)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 238, in handleEdit\r\n self.handleModification("edit", output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\config.py", line 218, in handleModification\r\n id, props = self.process_modification(id, props, type=type, output=output)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\rest_handler_dbmon.py", line 95, in process_modification\r\n self.validateConfig(stanza, props)\r\n

(to be continued)

[pacrip]

File "F:\Program Files\Splunk\etc\apps\dbx\bin\rest_handler_dbmon.py", line 126, in validateConfig\r\n executeBridgeCommand("com.splunk.dbx.monitor.DatabaseMonitorValidator", args, checkStatus=True)\r\n File "F:\Program Files\Splunk\etc\apps\dbx\bin\spp\java\bridge.py", line 182, in executeBridgeCommand\r\n raise JavaBridgeError("Command %s returned status code %s" % (cmd, ret))\r\nJavaBridgeError: Command com.splunk.dbx.monitor.DatabaseMonitorValidator returned status code 17\r\n\r\n 04-23-2015 11:10:37.261 +0100 ERROR AdminManagerExternal - Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Invalid interval value=*/5 * * * * for stanza dbmon-tail://RT... See splunkd.log for full data.

[frobinson_splun]

Thank you, @pacrip! Our cron scheduler experts are working on this. We tried recreating the error you were having, and could not get it to happen. Thanks for the note about your splunk SME not being able to reproduce it either. I'll send the error log along to our team and get back to you with what we figure out.

All best,
frobinson

[frobinson_splun]

@pacrip can you send me the exact name and version of the DBX app and any other software you're using for the cron scheduler?

thanks!
frobinson

[pacrip]

Hi Frobinson, we use DBX version 1.17

And to clarify our splunk SME was able to recreate the issue but was able to get around it by changing the job in the inputs.conf file after the job had been created using an acceptable cron.

[frobinson_splun]

Thanks, @pacrip! Relaying to our engineering team to check this out.

[frobinson_splun]

@pacrip: we've determined that this is a bug on the DB Connect 1/DBX version 1.17. I've assigned this to our apps team to take it from here. I will post back here with any further updates! Thanks for your input!

All best,
frobinson

[MuS]

Well, either the docs are wrong or this is a bug. You can file a bug here http://www.splunk.com/r/bugs

@piebob, can you check the docs on this topic please?

cheers, MuS

[piebob]

i'm asking the docteam to take a look!

[frobinson_splun]

Hi all!
I'm a docs writer here at Splunk and am looking into the issue with our engineering team. I'll let you know if it's a bug or a docs-correction issue!
All best,
frobinson

[frobinson_splun]

There are other posts here that seem related. First one I found:
http://answers.splunk.com/answers/177981/why-am-i-getting-invalid-cron-errors-using-a-cron-1.html

We're working to get to the bottom of what's going on here. More info soon!
🙂
frobinson