After restarting the Splunk forwarder, why is my Powershell script in inputs.conf only running once, not continuously?

[rajkumar3v]

Hi guys,

I am trying to Invoke output of a Powershell script in to Elasticsearch. In this Splunk forwarder, job is to just trigger the script and Invoke-WebRequest that will push the output into Elasticsearch.

1. When I restart the Splunk forwarder manually, the data is pushing in to Elasticsearch
2. After manual restart, Splunk is able to trigger the script only once automatically and it's not triggering the script continuously

inputs.conf

[powershell://Metric]
script = . "$SplunkHome\bin\scripts\metric.ps1"
schedule = */5 * * * *
sourcetype = Winmetric

Also I have tried with schedule = 5 * * ? * * & interval = 300 and no logs were generated in the splunkd file which is related to the script.

Forwarder version - 6.4.2
Thanks for any help

[sjohnson_splunk · Accepted solution]

I think your setting is incorrect for the schedule. From the inputs.conf.spec:

interval = [|]
* How often to execute the specified command (in seconds), or a valid cron
schedule.
* NOTE: when a cron schedule is specified, the script is not executed on
start-up.
* If specified as a number, may have a fractional component; e.g., 3.14
* Splunk's cron implementation does not currently support names of months/days.
* Defaults to 60.0 seconds.
* The special value 0 will force this scripted input to be executed non-stop;
that is, as soon as script exits, we shall re-start it.
* The special value -1 causes the scripted input to run once on start-up.

If you want it to run non-stop it should be:

interval=0

[sjohnson_splunk]

Sorry - I forgot you have it under a powershell stanza.

If you can't make that work, maybe you can run it under a script stanza where you could use the interval=0 setting

powershell -executionPolicy RemoteSigned -command .$SplunkHome\bin\scripts\metric.ps1