topic Input script processing time greater than trigger interval in Getting Data In

Input script processing time greater than trigger interval

King_Of_Shawn — Thu, 09 Sep 2021 08:45:31 GMT

I have a problem similar to this: Scripted Input timeout .

In modular input, i use python script to collect data, and in most cases, the single collection takes 10 minutes.

But my interval is set to 5 minutes.

Splunk will run the first one and wait until it finishes to start the next one? Right?

And the missed scheduling will be directly ignored?

Re: Input script processing time greater than trigger interval

richgalloway — Thu, 09 Sep 2021 11:25:08 GMT

You are correct on both counts.

Running every 5 minutes a search that takes 10 minutes makes little sense. You should change the interval.

Re: Input script processing time greater than trigger interval

King_Of_Shawn — Thu, 09 Sep 2021 14:54:40 GMT

Thank you for your reply. I have one more question. If i restart the Splunk server in the middle of the running of the modular input script, is there a default checkpoint mechanism for Splunk to restore the last unfinished trigger when the Splunk server start again? or just start a new processing at the next trigger time?

Re: Input script processing time greater than trigger interval

richgalloway — Thu, 09 Sep 2021 18:57:39 GMT

I'm sure exactly what happens in that scenario, but believe the modular input will simply stop. When Splunk restarts the modular input will be restarted, but it will not complete any unfinished work unless the script has specific provisions to do so.