topic Re: retrying a scripted input after a failure in Getting Data In

retrying a scripted input after a failure

Justin_Grant — Tue, 23 Feb 2010 04:47:59 GMT

[I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too]

I have a scripted input that talks to an SDEE interface on the Cisco IPS. This interface can be flakey at times and I am running into an issue where if a connection fails Splunk will no longer retry the script. I assumed with the scheduler set -1 it would just try to reconnect after the script exits. I am catching the exception and exiting gracefully but that doesn't seem to work or I am just doing it wrong. Can anyone give me a pointer as to what I need my script to do in order to get Splunk to retry it if the first connection fails.?

Re: retrying a scripted input after a failure

Will_Hayes — Tue, 23 Feb 2010 05:10:18 GMT

The interval need to be set to 1 not -1 for auto-retry on exit.

Re: retrying a scripted input after a failure

gkanapathy — Tue, 23 Feb 2010 06:30:08 GMT

If you set the interval to -1, it runs the script just once, when Splunk starts up. If you set it to 1, it runs the script again 1 second after the previous invocation exits. It's generally true for all scripted inputs that the next instance runs interval seconds after the exit of the previous invocation.