Deployment Architecture

scripted inputs execution interval

Explorer

I have deployed the unix app on universal forwarder.How to change default execution interval for the scripted inputs?

Tags (2)

Splunk Employee
Splunk Employee

For the *NIX app, the scripted inputs can be found in $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. Copy the parameters you want to change, and place them in $SPLUNK_HOME/etc/apps/unix/local/inputs.conf. If you modify the values in /default, they will be overwritten when your app is updated to a new version.

Note the "interval" parameter in the iostat.sh stanza in inputs.conf:

[script://./bin/iostat.sh]

interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

HTH

Splunk Employee
Splunk Employee

Copy the stanza into $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and override whatever values you want to change in the new file. For instance, set interval=. Values specified in conf files in /local will override those in /default

0 Karma

Explorer

What do you mean by "Note the "interval" parameter in the iostat.sh stanza in inputs.conf",it means that default interval execution can not be changed for iostat.sh and it is all time equal 60

0 Karma