Getting Data In

Powershell script input on a schedule

gavsdavs_GR
Path Finder

Not sure if this is a bug or just weird behaviour, I don't seem to be able to work around it.

I have loads of powershell windows inputs running on my UFs but they are running on UF restart as well as on their schedule(s).
{code}
[powershell://name]
script = & stuff
schedule = 0 23 15 * * *
source = PowerShell
sourcetype = PowerShell:Name
index = my index
interval =
{code}

I want this ONLY to run at 15:23.
What I am seeing is that if the UF is restarted, it's run on startup, AND it's run on the schedule i tell it.
i don't want it running on UF startup.

I believe i'm using the quartz notation and that bit is working as intended, but I don't want this input to be run if the UF is restarted.

Why is this happening ?

MayurSplunk
Explorer

Please share if the issue has been resolved in later releases.

0 Karma

MayurSplunk
Explorer

Any update on this ... has it been resolved by Splunk ?

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

I believe this is a known issue. Please raise a case with Splunk Support quoting SPL-141385.

adonio
Ultra Champion

its the default behavior to run scripted inputs on forwarder start, i am not sure however how (and why) to disable it

0 Karma

gavsdavs_GR
Path Finder

That isn't very desirable. If i supply a schedule, then that's when i want it to run, not whenever the UF is restarted.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...