topic Re: interval setting in inputs.conf is ignored in Getting Data In

Why is the interval setting in inputs.conf ignored?

mykol_j — Fri, 17 Mar 2023 18:34:37 GMT

Currently on v 9.0.3 (but has been happening forever).

On our universal forwarders we're using the Splunk provided bin apps for various things. In this example, I just noted the win_installed_apps.bat is running 78 times in a 24 hour period, even though the interval is set to once every 24 hours:

[script://.\bin\win_installed_apps.bat]
disabled = 0
## Run once per day
interval = 86400
sourcetype = Script:InstalledApps

Other examples that are set for 86400 seconds include win_timesync_configuration.bat and win_timesync_status.bat that both run 39 times a day.

We have a home grown script to check for compliance set to run every hour (3600 seconds) and it runs every hour like it should. Why are so many others ignored?

Thoughts?

Re: interval setting in inputs.conf is ignored

PickleRick — Thu, 16 Mar 2023 22:38:40 GMT

First things first - use the btool to verify that your effective configuration is what you think it is.

Re: interval setting in inputs.conf is ignored

gcusello — Fri, 17 Mar 2023 08:04:34 GMT

Hi @mykol_j,

I agree with @PickleRick, check the configurations using btool.

at the same time, setup (only for testing) a different interval, maybe the problem isn't the interval: e.g. execution rights on the script or the script location.

Ciao.

Giuseppe

Re: interval setting in inputs.conf is ignored

mykol_j — Fri, 17 Mar 2023 13:23:57 GMT

Thanks, guys.

Guess I need to learn to use btool...

I know, I know, I've just been lazy...

Grazie.

Re: interval setting in inputs.conf is ignored

mykol_j — Fri, 17 Mar 2023 14:04:09 GMT

PS C:\Program Files\SplunkUniversalForwarder\bin> .\btool.exe list inputs --debug
SPLUNK_HOME must be set. Stopping.

Never a dull moment...

Re: interval setting in inputs.conf is ignored

gcusello — Fri, 17 Mar 2023 14:31:04 GMT

hi @mykol_j,

see here for btool using; https://docs.splunk.com/Documentation/Splunk/9.0.4/Troubleshooting/Usebtooltotroubleshootconfigurations

Ciao.

Giuseppe

Re: interval setting in inputs.conf is ignored

PickleRick — Fri, 17 Mar 2023 15:22:51 GMT

See my response in

https://community.splunk.com/t5/Getting-Data-In/btool-quits-with-quot-SPLUNK-HOME-must-be-set-Stopping-quot/m-p/634938/highlight/true#M108654