Getting Data In

Can I set different interval of execution for different hosts receiving same scripted input app from deployment server?

saurabh009
Path Finder

Hi,
We have a requirement where we need to deploy an app having a script in it but interval of execution of script should differ for each hosts receiving the app.
Is this possible to do in the same app?

1 Solution

saurabh009
Path Finder

I found an easiest way to do it.
From inputs.conf , I am passing parameter to the script as TST1 and TST2 from separate monitoring stanza.
Each Stanza has their own execution interval and script reads the passed parameter and matches with the hostname where it's running.

Thanks for inputs @chrisyoungerjds @somesoni2

View solution in original post

woodcock
Esteemed Legend

There are 2 ways:
1: Have 2 different Splunk apps, each with a different cron setting for the search.
2: Use cron value of */12 * * * * and edit the script and have it check which server it is on. If it is on host 1, run on the first half and exit on the 2nd half doing nothing; otherwise, vice-versa.

0 Karma

saurabh009
Path Finder

I found an easiest way to do it.
From inputs.conf , I am passing parameter to the script as TST1 and TST2 from separate monitoring stanza.
Each Stanza has their own execution interval and script reads the passed parameter and matches with the hostname where it's running.

Thanks for inputs @chrisyoungerjds @somesoni2

chrisyounger
SplunkTrust
SplunkTrust

Option 1)
Write the logic into a small shell script that checks the host name and runs or doesn't run the child process.

Option 2)
Create a "common" app that contains the script and any other parts that need to be deployed.
Create a unique app for each unique time period you want the job to run for. These apps will not contain the script, but will contain just the inputs.conf and the stanza to specify the input and its run frequency. A stanza in one app can call a script from another app.
This is a good option becuase you don't have duplicated code or config.

Hope this helps

0 Karma

somesoni2
Revered Legend

Could you provide more details on your requirement like, how many different host-interval combination exists there, and do similar hosts (which requires same interval) follows a naming pattern? There is no direct way to achieve this but there may be a (dirty) workaround for it, but what's the purpose behind having different intervals?

0 Karma

saurabh009
Path Finder

We have two servers, each gets updated with network information every 12 hour, therefore we need to collect the information from each host at the interval of 12 hour.
Like script on host 1 should run at 12:00 afternoon and on host 2 it should run at 00:00 midnight.
both hosts starts with "TST" and differ by number appended at the end.
TST1 and TST2.

0 Karma

somesoni2
Revered Legend

If the host names are static, you could handle the execution (collection of network information) in your script itself. What I mean is , your script will run every 12 hour (OR a cron like 0 0,12 * * *) on both hosts. On every run, your script can check the current time and current host and skip execution based on host/time combination. ( if current hour is 0 and host=TST1, don't execute, if host=TST2 execute it.)

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...