topic Re: interval as a data input parameter in Getting Data In

interval as a data input parameter

shai — Sun, 03 Nov 2024 15:08:20 GMT

I want my customer to be able to set the "interval" and control how frequent the module runs.

I started with this:

default/inputs.conf

[app_name] interval = 43200

and it worked as a default fallback, but once I added it to inputs.conf.spec, things started to break

[app_name://<name>] interval = <integer>

The value was ignored. I tried 30 for every 30 seconds and tracked logs. further more I had this log message in my server:

Ignoring parameter "interval" for modular input "app_name" when scheduling the runtime for script="/opt/splunk/etc/apps/app_name/bin/script_name.py". This means potentially Splunk won't be restarting it in case it gets terminated.

What is the way to expose "interval" to end user?
(Ideally in "more options" at the Add Input UI. )

Re: interval as a data input parameter

sainag_splunk — Sun, 03 Nov 2024 21:07:26 GMT

Hello @shai have you also tried using cron job? Yes we need to define modinput on the inputs.conf.spec to get that populated on UI.
Can you also try with local/inputs.conf? What version of splunk are you running? I don't recall this must be an old known issue for windows. I recommend reaching out to support if your are stuck.

If this Helps, Please Upvote.

Re: interval as a data input parameter

shai — Sun, 10 Nov 2024 12:06:31 GMT

@sainag_splunk

not sure what you meant by using cron job... when interval is defined in default/inputs.conf it is already activating a crod job behind the scenes... only when exposed to UI thorugh inputs.conf.spec it stops doing so...

local/inputs.conf get's populated alright so idk what did you mean by trying it... after the user populates in the UI it is written into local/inputs.conf and then nothing happens.

I use splunk 9.2.1 over linux.

Re: interval as a data input parameter

tscroggins — Sun, 10 Nov 2024 16:36:52 GMT

Hi @shai,

Looking at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/custominputs/modinputsconfspec/, the interval setting should "just work;" however, the use_single_instance scheme parameter controls its behavior.

Is use_single_instance set to false in your modular input's scheme? E.g.:

<scheme>  <use_single_instance>false</use_single_instance>  </scheme>

Re: interval as a data input parameter

shai — Tue, 12 Nov 2024 13:04:25 GMT

That's helpful to understand the problem!

Still I don't fully understand the solusion.

What are my options if I want to expose interval to client and still keep application single instance?