diff --git a/vql/linux/cronsnoop/cron-lib.go b/vql/linux/cronsnoop/cron-lib.go
index 940bfcb76..3968eb196 100644
--- a/vql/linux/cronsnoop/cron-lib.go
+++ b/vql/linux/cronsnoop/cron-lib.go
@@ -203,7 +203,7 @@ func special_cron_string(line_fields []string) bool {
 
 func should_skip_line(line_fields []string) bool {
 	// ignore comments and empty lines
-	if line_fields[0][0] == '#' || len(line_fields) == 0 {
+	if len(line_fields) == 0 || len(line_fields[0]) == 0 || line_fields[0][0] == '#' {
 		return true
 	}
 
diff --git a/vql/linux/cronsnoop/cron_test.go b/vql/linux/cronsnoop/cron_test.go
index 34e5d22ac..f1e7037d1 100644
--- a/vql/linux/cronsnoop/cron_test.go
+++ b/vql/linux/cronsnoop/cron_test.go
@@ -367,6 +367,13 @@ func TestMultiUserCommentIgnore(t *testing.T) {
 	assertMUserDoesntExist("user3", fName, s, t)
 }
 
+func TestShouldSkipLineEmptyLine(t *testing.T) {
+	fields := []string{""}
+	if !should_skip_line(fields) {
+		t.Fatal("Empty line should be skipped")
+	}
+}
+
 func TestMultiUserSpecialStringHandling(t *testing.T) {
 	tempdir := t.TempDir()