Is there a way to specify a value for a modular input interval?

[jrobins]

I configured an interval of 60s for my custom data input via the GUI. The script is getting executed every 60s as expected but if the script execution itself takes more than 60 seconds, the modular input stops and never gets executed again. Has anyone experienced this? I

Another question: Is there any way to specify a value for the interval so that it automatically gets executed right after current execution is completed?

[thambisetty]

does the modular input start again after the task is complete?

yes, if the script exits completely otherwise no, if script is stuck for some reason.
Please check updated answer as below:

The reason for stopping completely and not honoring next schedules if its taking more than 60 seconds is script might be in waiting state this mostly occurs if there is a network issue or if script is trying to get response from endpoint and it never got any such response. you can see these kind of processes with script name in CLI using ps Linux command or you could see how long your script is running using index=_introspection.

[jrobins]

@thambisetty this is the issue i am facing, the script completely exits, but still then the next iteration is not getting spawned.

[ohbuckeyeio]

Old post but following up in case anyone else has this same issue.

Mine was caused by setting this to True in my get_scheme:

scheme.use_single_instance = False

I also had 2 stanza in my inputs.conf for the same script and the first one had an interval of "-1"

I think the combination of the two ensured my stanzas would run once, then that was it until I restarted Splunk or enabled/disabled either of the stanzas.

[thambisetty]

Splunk Enterprise will not run upcoming schedule if the existing process is still running. 

The reason for stopping completely and not honoring next schedules if its taking more than 60 seconds is script might be in waiting state this mostly occurs if there is a network issue or if script is trying to get response from endpoint and it never got any such response. you can see these kind of processes with script name in CLI using ps Linux command or you could see how long your script is running using index=_introspection.

In your case, Splunk will schedule job for every 60 seconds and if there is a process for modular input is over running then Splunk will skip until existing job is complete. It's default behavior of Splunk modular/script inputs.

-------------

up vote if it solves your problem.

[jrobins]

@thambisetty Thanks for the reply. In your response you mentioned "Splunk will schedule job for every 60 seconds and if there is a process for modular input is over running then Splunk will skip until existing job is complete." Say, the task took 65 seconds to complete, does the modular input start again after the task is complete? The reason am asking is, once the task takes more than the interval, even when the task is complete I don't see splunk scheduling the next job. The scheduling works for me only when job finishes in 60 seconds, if it goes above 60 no future executions are happening even when the job is completed.