Getting Data In

Data input script stop !

thkwon
Explorer

I am collecting logs every 5 seconds using a script.
However, script execution is suddenly stopped.
Why does the script stop? Is it a Splunk bug?
My version is 7.3.3.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Tell us more about the script and how it is run.  Splunk does not run scripts every 5 seconds so how are you doing so?

Did your script log an error when it failed?  Did the process running the script log an error?  What else happened at the time the script stopped?

---
If this reply helps you, Karma would be appreciated.
0 Karma

thkwon
Explorer

This script uses APIs from other systems to get results.

0 Karma

thkwon
Explorer

Hello richgalloway 

Splunk can run scripts with crontab and second.

Error message is 
02-09-2021 09:24:19.099 +0900 ERROR ExecProcessor - message from "/home/splunk/splunk/bin/scripts/REALTIME.sh"

Error Message occurs whenever a script is executed.

Then at some point, the result of the script does not occur.

click disable to run the script again, enable must click.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

One way to test your script is: 

 

splunk cmd <path to your script>

 

 r. Ismo

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...