Alerting

Is it possible to have scripted input get executed once on startup, and then again in the cron schedule?

big_nuggets
Explorer

Hi,

I'm trying to have scripted input get executed once on startup, and then again in the cron schedule. So far, I've been able to get one or the other, not able to get both to work simultaneously any help would be appreciated.

This is what I have now:

[script://./bin/starter_script.sh]
 interval = 0 9 * * *
 # this will run the script daily @ 9

[script://./bin/starter_script.sh]
 interval = -1
 # this will execute the script on startup

 

Labels (1)
0 Karma

chris_barrett
SplunkTrust
SplunkTrust
[script://./bin/starter_script.sh periodic]
interval = 0 9 * * *
# this will run the script daily @ 9

[script://./bin/starter_script.sh on-start]
interval = -1
# this will execute the script on startup

The above (or at least a variation of it) worked for me.  The TA in question was only distributed to Linux hosts so I don't know if the same trick will work on windows hosts.  And I'm not sure if the label gets treated as an argument because, in my case, my script didn't attempt to read in any command line arguments.

The label at the end of each of the stanzas is not significant - they just need to be different so that the stanza merging logic treats them as two separate stanzas.  And if you have two scripts that you wish to run both on start up and periodically then you can reuse the same label.

[script//./bin/script1.sh on-start]
interval = -1

[script://./bin/script1.sh midnight]
interval = 0 0 * * * 

[script//./bin/script2.sh on-start]
interval = -1

[script://./bin/script2.sh midnight]
interval = 0 0 * * * 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...