Alerting

Is it possible to have scripted input get executed once on startup, and then again in the cron schedule?

big_nuggets
Explorer

Hi,

I'm trying to have scripted input get executed once on startup, and then again in the cron schedule. So far, I've been able to get one or the other, not able to get both to work simultaneously any help would be appreciated.

This is what I have now:

[script://./bin/starter_script.sh]
 interval = 0 9 * * *
 # this will run the script daily @ 9

[script://./bin/starter_script.sh]
 interval = -1
 # this will execute the script on startup

 

Labels (1)
0 Karma

chris_barrett
SplunkTrust
SplunkTrust
[script://./bin/starter_script.sh periodic]
interval = 0 9 * * *
# this will run the script daily @ 9

[script://./bin/starter_script.sh on-start]
interval = -1
# this will execute the script on startup

The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments.

The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label.

[script//./bin/script1.sh on-start]
interval = -1

[script://./bin/script1.sh midnight]
interval = 0 0 * * * 

[script//./bin/script2.sh on-start]
interval = -1

[script://./bin/script2.sh midnight]
interval = 0 0 * * * 

 

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...