All Apps and Add-ons not running with the interval

Path Finder

In my app

opt/splunk/etc/apps/cust_unix/local/inputs.conf I have these lines below, and I'm assume it will run every 5 sec. Seems like it'll run whenever it feel like, and no time pattern. How to debug this?

sourcetype = cpu
source = cpu
interval = 5
index = os
disabled = 0
. dirname $0/

HEADER='CPU pctUser pctNice pctSystem pctIowait pctIdle'
PRINTF='{printf "%-3s %9s %9s %9s %9s %9s\n", cpu, pctUser, pctNice, pctSystem, pctIowait, pctIdle}'

if [ "x$KERNEL" = "xLinux" ] ; then
queryHaveCommand sar
queryHaveCommand mpstat
if [ $FOUND_SAR -eq 0 ] ; then
CMD='sar -P ALL 1 1'
FORMAT='{cpu=$(NF-6); pctUser=$(NF-5); pctNice=$(NF-4); pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$NF}'
elif [ $FOUND_MPSTAT -eq 0 ] ; then
CMD='mpstat -P ALL 1 1'
FORMAT='{cpu=$(NF-9); pctUser=$(NF-8); pctNice=$(NF-7); pctSystem=$(NF-6); pctIowait=$(NF-5); pctIdle=$(NF-1)}'
failLackMultipleCommands sar mpstat
FILTER='/Average|Linux|^$|%/ {next} (NR==1) {next}'
elif [ "x$KERNEL" = "xSunOS" ] ; then
if [ $SOLARIS_8 -o $SOLARIS_9 ] ; then
CMD='mpstat -p 1 2'
CMD='mpstat -q -p 1 2'
assertHaveCommand $CMD
FILTER='(NR<=2) {next} ($1 >= "0") {inBlock=1} (!inBlock) {next}'
FORMAT='{cpu=$1; pctUser=$(NF-4); pctNice="?"; pctSystem=$(NF-3); pctIowait=$(NF-2); pctIdle=$(NF-1)}'
elif [ "x$KERNEL" = "xDarwin" ] ; then
CMD='sar -u 1'
assertHaveCommand $CMD
FILTER='($0 !~ "Average") {next}'
FORMAT='{cpu="all"; pctUser=$2; pctNice=$3; pctSystem=$4; pctIdle=$5; pctIowait="?"}'
elif [ "x$KERNEL" = "xFreeBSD" ] ; then
CMD='iostat -C -c 2'
assertHaveCommand $CMD
FILTER='(NR<4) {next}'
FORMAT='{cpu="all"; pctUser=$(NF-4); pctNice=$(NF-3); pctSystem=$(NF-2); pctIdle=$NF; pctIowait="?"}'

echo "Cmd = [$CMD]; | $AWK '$HEADERIZE $FILTER $FORMAT $PRINTF' header=\"$HEADER\"" >> $TEE_DEST

0 Karma


interval is generally in seconds unless you specify in crontab format:
interval = [|]
* How often to execute the specified command (in seconds), or a valid cron schedule.
* NOTE: when a cron schedule is specified, the script is not executed on start-up.
* Defaults to 60 seconds.

I'm not sure how the passAuth actually functions, but I would expect (since I'm not seeing additional information for configuring sudo) that it can't elevate it's priviliges, but only drop from root to another user. You could wrap it in another script to use sudo.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!