I am trying to Invoke output of a Powershell script in to Elasticsearch. In this Splunk forwarder, job is to just trigger the script and Invoke-WebRequest that will push the output into Elasticsearch.
[powershell://Metric] script = . "$SplunkHome\bin\scripts\metric.ps1" schedule = */5 * * * * sourcetype = Winmetric
Also I have tried with
schedule = 5 * * ? * * &
interval = 300 and no logs were generated in the splunkd file which is related to the script.
Forwarder version - 6.4.2
Thanks for any help
I think your setting is incorrect for the schedule. From the inputs.conf.spec:
interval = [|]
* How often to execute the specified command (in seconds), or a valid cron
* NOTE: when a cron schedule is specified, the script is not executed on
* If specified as a number, may have a fractional component; e.g., 3.14
* Splunk's cron implementation does not currently support names of months/days.
* Defaults to 60.0 seconds.
* The special value 0 will force this scripted input to be executed non-stop;
that is, as soon as script exits, we shall re-start it.
* The special value -1 causes the scripted input to run once on start-up.
If you want it to run non-stop it should be:
Sorry - I forgot you have it under a powershell stanza.
If you can't make that work, maybe you can run it under a script stanza where you could use the interval=0 setting
powershell -executionPolicy RemoteSigned -command .$SplunkHome\bin\scripts\metric.ps1