topic Re: scripted inputs execution interval in Deployment Architecture

scripted inputs execution interval

bwenge — Thu, 12 May 2011 14:46:16 GMT

I have deployed the unix app on universal forwarder.How to change default execution interval for the scripted inputs?

Re: scripted inputs execution interval

Ron_Naken — Mon, 28 Sep 2020 09:33:21 GMT

For the *NIX app, the scripted inputs can be found in $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. Copy the parameters you want to change, and place them in $SPLUNK_HOME/etc/apps/unix/local/inputs.conf. If you modify the values in /default, they will be overwritten when your app is updated to a new version.

Note the "interval" parameter in the iostat.sh stanza in inputs.conf:

[script://./bin/iostat.sh]

interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

HTH

Re: scripted inputs execution interval

bwenge — Thu, 12 May 2011 15:43:06 GMT

What do you mean by "Note the "interval" parameter in the iostat.sh stanza in inputs.conf",it means that default interval execution can not be changed for iostat.sh and it is all time equal 60

Re: scripted inputs execution interval

Ron_Naken — Thu, 12 May 2011 15:46:57 GMT

Copy the stanza into $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and override whatever values you want to change in the new file. For instance, set interval=. Values specified in conf files in /local will override those in /default