How can I set a PowerShell script to run on startup and every 24 hours thereafter on a UF? I have tried using
schedule. Most of my UFs are 7.1.4 but there are some older 6.6 UFs floating around.
If I only use
interval, it will run at startup, but not at any interval.
If I only use
schedule, it will run on the schedule, either using time in seconds or cron, but not at startup.
If I use
schedule, it will only follow the schedule parameter.
[powershell://LocalAdministrators] disabled = 0 script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1" interval = 86400 schedule = 86400
interval does not work for specific powershell stanzas. You can set it for the modular input as a whole like so:
[powershell] interval = 60
But that just specifies how frequently Splunk tries to run
splunk-powershell.exe, just as with all the other Windows modular inputs (and like a lot of the other modular inputs, if there are any specific stanzas defined, then the modular input executable will run continuously, and only be restarted if it crashes, say).
In terms of what you'd like to achieve, it is possible, albeit in a slightly hacky way. What you basically need to do is to use two stanzas; e.g.:
[powershell://LocalAdministrators-AtStart] script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1" [powershell://LocalAdministrators-EveryDay] script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1" schedule = 86400
schedule means that the script is only run once.)
Hope this helps!
"Hacky" solution it is, since it appears to meet my needs in my testing.
Thanks for the information on
interval. I started trying use that because Splunk Support told me to...