Alerting

Is it possible to have scripted input get executed once on startup, and then again in the cron schedule?

big_nuggets
Explorer

Hi,

I'm trying to have scripted input get executed once on startup, and then again in the cron schedule. So far, I've been able to get one or the other, not able to get both to work simultaneously any help would be appreciated.

This is what I have now:

[script://./bin/starter_script.sh]
 interval = 0 9 * * *
 # this will run the script daily @ 9

[script://./bin/starter_script.sh]
 interval = -1
 # this will execute the script on startup

 

Labels (1)
0 Karma

chris_barrett
SplunkTrust
SplunkTrust
[script://./bin/starter_script.sh periodic]
interval = 0 9 * * *
# this will run the script daily @ 9

[script://./bin/starter_script.sh on-start]
interval = -1
# this will execute the script on startup

The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments.

The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label.

[script//./bin/script1.sh on-start]
interval = -1

[script://./bin/script1.sh midnight]
interval = 0 0 * * * 

[script//./bin/script2.sh on-start]
interval = -1

[script://./bin/script2.sh midnight]
interval = 0 0 * * * 

 

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...