Input script processing time greater than trigger interval

[King_Of_Shawn]

I have a problem similar to this: Scripted Input timeout .

In modular input, i use python script to collect data, and in most cases, the single collection takes 10 minutes.

But my interval is set to 5 minutes.

Splunk will run the first one and wait until it finishes to start the next one? Right?

And the missed scheduling will be directly ignored?

[richgalloway · Accepted solution]

You are correct on both counts.

Running every 5 minutes a search that takes 10 minutes makes little sense.  You should change the interval.

[King_Of_Shawn]

Thank you for your reply. I have one more question. If i restart the Splunk server in the middle of the running of the modular input script, is there a default checkpoint mechanism for Splunk to restore the last unfinished trigger when the Splunk server start again? or just start a new processing at the next trigger time?

[richgalloway]

I'm sure exactly what happens in that scenario, but believe the modular input will simply stop.  When Splunk restarts the modular input will be restarted, but it will not complete any unfinished work unless the script has specific provisions to do so.