All Apps and Add-ons not running with the interval

Path Finder

In my app

opt/splunk/etc/apps/cust_unix/local/inputs.conf I have these lines below, and I'm assume it will run every 5 sec. Seems like it'll run whenever it feel like, and no time pattern. How to debug this?

sourcetype = cpu
source = cpu
interval = 5
index = os
disabled = 0
. dirname $0/

HEADER='CPU pctUser pctNice pctSystem pctIowait pctIdle'
PRINTF='{printf "%-3s %9s %9s %9s %9s %9s\n", cpu, pctUser, pctNice, pctSystem, pctIowait, pctIdle}'

if [ "x$KERNEL" = "xLinux" ] ; then
queryHaveCommand sar
queryHaveCommand mpstat
if [ $FOUND_SAR -eq 0 ] ; then
CMD='sar -P ALL 1 1'
FORMAT='{cpu=$(NF-6); pctUser=$(NF-5); pctNice=$(NF-4); pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$NF}'
elif [ $FOUND_MPSTAT -eq 0 ] ; then
CMD='mpstat -P ALL 1 1'
FORMAT='{cpu=$(NF-9); pctUser=$(NF-8); pctNice=$(NF-7); pctSystem=$(NF-6); pctIowait=$(NF-5); pctIdle=$(NF-1)}'
failLackMultipleCommands sar mpstat
FILTER='/Average|Linux|^$|%/ {next} (NR==1) {next}'
elif [ "x$KERNEL" = "xSunOS" ] ; then
if [ $SOLARIS_8 -o $SOLARIS_9 ] ; then
CMD='mpstat -p 1 2'
CMD='mpstat -q -p 1 2'
assertHaveCommand $CMD
FILTER='(NR<=2) {next} ($1 >= "0") {inBlock=1} (!inBlock) {next}'
FORMAT='{cpu=$1; pctUser=$(NF-4); pctNice="?"; pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$(NF-1)}'
elif [ "x$KERNEL" = "xDarwin" ] ; then
CMD='sar -u 1'
assertHaveCommand $CMD
FILTER='($0 !~ "Average") {next}'
FORMAT='{cpu="all"; pctUser=$2; pctNice=$3; pctSystem=$4; pctIdle=$5; pctIowait="?"}'
elif [ "x$KERNEL" = "xFreeBSD" ] ; then
CMD='iostat -C -c 2'
assertHaveCommand $CMD
FILTER='(NR<4) {next}'
FORMAT='{cpu="all"; pctUser=$(NF-4); pctNice=$(NF-3); pctSystem=$(NF-2); pctIdle=$NF; pctIowait="?"}'

echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILTER $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST

0 Karma


interval is generally in seconds unless you specify in crontab format:
interval = [|]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.
* Defaults to 60 seconds.

I'm not sure how the passAuth actually functions, but I would expect (since I'm not seeing additional information for configuring sudo) that it can't elevate it's priviliges, but only drop from root to another user. You could wrap it in another script to use sudo.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...