Alerting

Is it possible to have scripted input get executed once on startup, and then again in the cron schedule?

big_nuggets
Explorer

Hi,

I'm trying to have scripted input get executed once on startup, and then again in the cron schedule. So far, I've been able to get one or the other, not able to get both to work simultaneously any help would be appreciated.

This is what I have now:

[script://./bin/starter_script.sh]
 interval = 0 9 * * *
 # this will run the script daily @ 9

[script://./bin/starter_script.sh]
 interval = -1
 # this will execute the script on startup

 

Labels (1)
0 Karma

chris_barrett
SplunkTrust
SplunkTrust
[script://./bin/starter_script.sh periodic]
interval = 0 9 * * *
# this will run the script daily @ 9

[script://./bin/starter_script.sh on-start]
interval = -1
# this will execute the script on startup

The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments.

The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label.

[script//./bin/script1.sh on-start]
interval = -1

[script://./bin/script1.sh midnight]
interval = 0 0 * * * 

[script//./bin/script2.sh on-start]
interval = -1

[script://./bin/script2.sh midnight]
interval = 0 0 * * * 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...