Checkpointing scripts for subsequent invocations

[dveith]

I'm writing an Add-on script for the universal forwarder that will read several log files containing complex data and reformat the data so that Splunk can more easily parse it.

Does my script need to implement it's own logic for "where it left off last time it was invoked" or does Splunk help with that somehow?

In other words, is it possible to have 'monitor' functionality, but with my own custom script?

Thanks.

[dwaddle]

If you script is being run as a scripted input, then you will need to maintain last-run state for yourself. Some of Splunk's own scripted inputs (like in the *nix app) do this as well - by keeping a file with an epoch time stored in it.