Splunk Apps » Network Tools

• Ability to parse cron schedule
• Ability to derive when the schedule indicates a run should happen

Some libraries:

• Two files
• Don't see a way to parse

• Not a single file
• Can take a string in parse() and run the default function

• Allows the designation of the current time
• Used in REST API mod input

• Not a cron scheduler

• Seems a little heavy
• Not a single file

• Might be a good fit
• Not sure if it needs a complete cron or just a time
• Not sure how to run missed inputs

https://pypi.python.org/pypi/python-crontab

Could make the cron schedule readable with https://pypi.python.org/pypi/cron_descriptor/1.2.0

This one looks good: https://pypi.python.org/pypi/croniter/

I think the algorithm could work like this:

1. Every minute, check to see if the input should run: job.check_trigger()
2. If so, execute

• What happens when the search has missed execution
  • I think we should do nothing
• Should this only be used with multi-threaded, or multi-instance mode since otherwise a flooded system may skip inputs?
  • Probably
• Should the check time be made more frequent? 15 seconds means that only 4 inputs can be executed per minute.

https://splunkbase.splunk.com/app/1546/ uses croniter

Dependencies:

• crontab
  • croniter
    • six
    • dateutil