topic Re: Script input runs once, then never again in Getting Data In

Script input runs once, then never again

twinspop — Thu, 20 Sep 2012 14:39:33 GMT

Inputs entry is:

[script://./bin/db_lockout_query.rb]
disabled = 0
sourcetype = dbjobs
source = db_lockout_query.rb
interval = 3600

When I restarted the Splunk forwarder, the input ran one time, and worked as expected. Splunkd.log shows:

09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor - New scheduled exec process: /opt/splunkforwarder/etc/apps/db_queries/bin/db_lockout_query.rb
09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor -     interval: 3600000 ms

and

09-18-2012 12:25:01.070 -0500 INFO  ExecProcessor - Ran script: /opt/splunkforwarder/etc/apps/db_queries
/bin/db_lockout_query.rb, took 15.16 seconds to run, 9722 bytes read

But never refers to the lockout query script again. I just changed the inputs stanza to use cron instead to see if that helps.

In the meantime, any ideas?

EDIT: Linux, 32-bit SUF, version 4.3.4

Re: Script input runs once, then never again

mixolydian — Thu, 20 Sep 2012 14:58:57 GMT

Are you sure that the script is exiting properly? If it is still running, Splunk won't run it again.

Update: Nevermind, from your output it appears that it is.

Re: Script input runs once, then never again

twinspop — Thu, 27 Sep 2012 16:12:46 GMT

I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."