Getting Data In

After restarting the Splunk forwarder, why is my Powershell script in inputs.conf only running once, not continuously?

rajkumar3v
New Member

Hi guys,

I am trying to Invoke output of a Powershell script in to Elasticsearch. In this Splunk forwarder, job is to just trigger the script and Invoke-WebRequest that will push the output into Elasticsearch.

  1. When I restart the Splunk forwarder manually, the data is pushing in to Elasticsearch
  2. After manual restart, Splunk is able to trigger the script only once automatically and it's not triggering the script continuously

inputs.conf

[powershell://Metric]
script = . "$SplunkHome\bin\scripts\metric.ps1"
schedule = */5 * * * *
sourcetype = Winmetric

Also I have tried with schedule = 5 * * ? * * & interval = 300 and no logs were generated in the splunkd file which is related to the script.

Forwarder version - 6.4.2
Thanks for any help

0 Karma
1 Solution

sjohnson_splunk
Splunk Employee
Splunk Employee

I think your setting is incorrect for the schedule. From the inputs.conf.spec:

interval = [|]
* How often to execute the specified command (in seconds), or a valid cron
schedule.
* NOTE: when a cron schedule is specified, the script is not executed on
start-up.
* If specified as a number, may have a fractional component; e.g., 3.14
* Splunk's cron implementation does not currently support names of months/days.
* Defaults to 60.0 seconds.
* The special value 0 will force this scripted input to be executed non-stop;
that is, as soon as script exits, we shall re-start it.
* The special value -1 causes the scripted input to run once on start-up.

If you want it to run non-stop it should be:

interval=0

View solution in original post

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

I think your setting is incorrect for the schedule. From the inputs.conf.spec:

interval = [|]
* How often to execute the specified command (in seconds), or a valid cron
schedule.
* NOTE: when a cron schedule is specified, the script is not executed on
start-up.
* If specified as a number, may have a fractional component; e.g., 3.14
* Splunk's cron implementation does not currently support names of months/days.
* Defaults to 60.0 seconds.
* The special value 0 will force this scripted input to be executed non-stop;
that is, as soon as script exits, we shall re-start it.
* The special value -1 causes the scripted input to run once on start-up.

If you want it to run non-stop it should be:

interval=0

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

Sorry - I forgot you have it under a powershell stanza.

If you can't make that work, maybe you can run it under a script stanza where you could use the interval=0 setting

powershell -executionPolicy RemoteSigned -command .$SplunkHome\bin\scripts\metric.ps1
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...