Getting Data In

Data input script stop !

thkwon
Explorer

I am collecting logs every 5 seconds using a script.
However, script execution is suddenly stopped.
Why does the script stop? Is it a Splunk bug?
My version is 7.3.3.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Tell us more about the script and how it is run.  Splunk does not run scripts every 5 seconds so how are you doing so?

Did your script log an error when it failed?  Did the process running the script log an error?  What else happened at the time the script stopped?

---
If this reply helps you, Karma would be appreciated.
0 Karma

thkwon
Explorer

This script uses APIs from other systems to get results.

0 Karma

thkwon
Explorer

Hello richgalloway 

Splunk can run scripts with crontab and second.

Error message is 
02-09-2021 09:24:19.099 +0900 ERROR ExecProcessor - message from "/home/splunk/splunk/bin/scripts/REALTIME.sh"

Error Message occurs whenever a script is executed.

Then at some point, the result of the script does not occur.

click disable to run the script again, enable must click.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One way to test your script is: 

 

splunk cmd <path to your script>

 

 r. Ismo

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...