topic Re: How can I make the Powershell add-on script's run on a schedule? in Getting Data In

How can I make the Powershell add-on script's run on a schedule?

eduardKiyko — Tue, 24 Apr 2018 13:18:50 GMT

I have an add-on that I'm deploying on Windows systems. inputs.conf looks like this:
[powershell://Processes-EX1]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\Powershell_add_on\bin\Get-Policies.ps1
schedule = 0 * * *
sourcetype = WindowsPowershell
index = test
disabled = 0
I want this to run at every minute 0, every hour.
But It runs only once when I start Universal Forwarder. Then, when I restart forwarder, it runs again and only once. When forwarder is working for 2 or more hours(script should run at least 2 times) just nothing happens.
How can I make scripts run on schedule?

Re: How can I make the Powershell add-on script's run on a schedule?

Kendo213 — Sat, 05 May 2018 00:16:33 GMT

I'm encountering the same issue. Did you find a resolution?

Re: How can I make the Powershell add-on script's run on a schedule?

paulathome — Sat, 05 May 2018 00:26:32 GMT

Nope, not yet. Using Task Scheduler for now... (It's only on one machine.)

Re: How can I make the Powershell add-on script's run on a schedule?

Kendo213 — Sat, 05 May 2018 00:35:45 GMT

I'm having a similar issue. Basically I've configured it to run every 5 minutes (splunkd doesn't say it's an invalid cron), however it only runs once at start. Sometimes it will run once at start, and then 5 minutes later (so I know the cron is correct) but then never again. If I do it the old way (i.e. cmd and invoking powershell) it works fine.

Re: How can I make the Powershell add-on script's run on a schedule?

kamal_jagga — Sun, 24 Jun 2018 20:15:28 GMT

In the inputs.conf make the following entry to run it every 30 mins (30*60). default is 5 mins.

interval = 1800

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf

Re: How can I make the Powershell add-on script's run on a schedule?

MuS — Sun, 24 Jun 2018 20:44:16 GMT

Hi eduardKiyko,

looking at your schedule = 0 * * * entry it looks like your are missing one additional * . Therefore this is not a valid cron schedule and Splunk uses the default option for schedule. From the docs https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

schedule = [<number>|<cron schedule>]
* How often to run the specified PowerShell command or script.
* You can specify a number in seconds, or provide a valid cron
  schedule.
* Defaults to running the command or script once, at startup.

Find more details on valid cron notation here https://en.wikipedia.org/wiki/Cron#Overview

Hope this helps ...

cheers, MuS