SA-croniter

Custom command to parse cron notation into epoch timestamps. Takes the search earliest time of the search as time from whence the next occurrence of the cron will be. Parameters are input=fieldname and timerange=numberInSeconds default to just providing next_epoch Example: index=_internal [ | makeresults | eval cronstring="*/5 * * * *" | croniter input=cronstring timerange="1" | eval nice_next_epoch=strftime(next_epoch,"%Y-%m-%d %H:%M:%S") | fields earliest,latest | format ] Will search events one second before the cron task runs till one second after