Getting Data In

Can a universal forwarder run a script? If yes, is there a way to control when it runs?



Can a UF run a script? If so, is there any way to control when it runs?

Splunk Employee
Splunk Employee

You can use a cron-like schedule in the "interval" field of the scripted input, see the docs at the link below.

Revered Legend

YOu can configure a scripted input in UF, so yes it can run a script. And you can specify the interval it should run in the inputs.conf.
See this

Path Finder

8 years later, the link is broken 😞

0 Karma


New working link that always point to latest version 🙂

0 Karma


Thank you, both these links helped me in achieving my desired output.

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...