Alerting

Is it possible to have scripted input get executed once on startup, and then again in the cron schedule?

big_nuggets
Explorer

Hi,

I'm trying to have scripted input get executed once on startup, and then again in the cron schedule. So far, I've been able to get one or the other, not able to get both to work simultaneously any help would be appreciated.

This is what I have now:

[script://./bin/starter_script.sh]
 interval = 0 9 * * *
 # this will run the script daily @ 9

[script://./bin/starter_script.sh]
 interval = -1
 # this will execute the script on startup

 

Labels (1)
0 Karma

chris_barrett
SplunkTrust
SplunkTrust
[script://./bin/starter_script.sh periodic]
interval = 0 9 * * *
# this will run the script daily @ 9

[script://./bin/starter_script.sh on-start]
interval = -1
# this will execute the script on startup

The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments.

The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label.

[script//./bin/script1.sh on-start]
interval = -1

[script://./bin/script1.sh midnight]
interval = 0 0 * * * 

[script//./bin/script2.sh on-start]
interval = -1

[script://./bin/script2.sh midnight]
interval = 0 0 * * * 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...