Getting Data In

Powershell script input on a schedule

gavsdavs_GR
Path Finder

Not sure if this is a bug or just weird behaviour, I don't seem to be able to work around it.

I have loads of powershell windows inputs running on my UFs but they are running on UF restart as well as on their schedule(s).
{code}
[powershell://name]
script = & stuff
schedule = 0 23 15 * * *
source = PowerShell
sourcetype = PowerShell:Name
index = my index
interval =
{code}

I want this ONLY to run at 15:23.
What I am seeing is that if the UF is restarted, it's run on startup, AND it's run on the schedule i tell it.
i don't want it running on UF startup.

I believe i'm using the quartz notation and that bit is working as intended, but I don't want this input to be run if the UF is restarted.

Why is this happening ?

MayurSplunk
Explorer

Please share if the issue has been resolved in later releases.

0 Karma

MayurSplunk
Explorer

Any update on this ... has it been resolved by Splunk ?

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

I believe this is a known issue. Please raise a case with Splunk Support quoting SPL-141385.

psla
Loves-to-Learn Everything

Any update? This issue still persists in 9.1.x version (and I assume in 9.2.x also because there is no information in release notes/fixed issues). Now it's very difficult to control the execution of scripts.

[script://] input has this feature implemented, but [powershell://] don't.

* NOTE: when you specify a cron schedule, the input does not run the
  script on start-up.

 

0 Karma

adonio
Ultra Champion

its the default behavior to run scripted inputs on forwarder start, i am not sure however how (and why) to disable it

0 Karma

gavsdavs_GR
Path Finder

That isn't very desirable. If i supply a schedule, then that's when i want it to run, not whenever the UF is restarted.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...