Advanced - Using a CRON Expression

If you're configuring a Script Source and need to specify a frequency that's different than any existing option, you can specify a CRON expression to collect data at a custom frequency.

note

For examples, see CRON Examples and Reference. 

Sumo Logic supports the Quartz CRON framework.

To use a CRON Expression in a Script Source:

1. Classic UI. In the main Sumo Logic menu, select Manage Data > Collection > Collection.
   New UI. In the Sumo Logic top menu select Configuration, and then under Data Collection select Collection. You can also click the Go To... menu at the top of the screen and select Collection.

2. Click Add Source for the Collector you choose.

3. Select Script for the Source type.

4. Enter the source name, description (optional), source host, and source category.

5. For Frequency, choose Other (CRON Expression), then type the expression.

   

6. If you'd like to set a timeout for your script, select Specify a timeout for your command. If you do not need a timeout, or if you're running a script once daily, we recommend that you leave this option deselected. Learn more in Configuring a Script Source.

7. For Command, choose the type of command you're going to use. The options in this menu depend on the type of Collector you're using:

   • Mac/Linux Command options.

     

   • Windows Command options.

     

8. For Script, do one of the following:

   • Choose Type a path to the script to execute if you have the script saved to a file location. For example:

   

   • Choose Type the script to execute if you'd like to enter the script directly in Logic. Then type the script in the text box. For example:

   

9. For Working Directory, you'll only need to enter a path if your script refers to a file indirectly. So, enter the path of the file you'd like to collect if required; otherwise this option can remain blank.

10. Click Advanced to see options regarding timestamps and time zones:

    • Timestamp Parsing. By default Extract timestamp information from log file entries is selected, meaning that Sumo Logic will use the timestamp information from the data you collect. Deselecting this option turns off all timestamp parsing.
    • Time Zone. Select an option under Use time zone from log file, but if none present use. Or, if you'd like to override all time zones from data you collect, choose an option under Ignore time zone and instead use.

11. For Multiline Processing, by default only Boundary Regex is selected. To make any changes to this setting, select Detect messages spanning multiple lines only if the type of data you're collecting is suited to being collected as multiline log messages.

12. If you'd like to filter data being collected, set Filter options. See Create a Processing Rule for more information.

13. Click Save to complete the Source setup.