Not sure if this is a bug or just weird behaviour, I don't seem to be able to work around it.
I have loads of powershell windows inputs running on my UFs but they are running on UF restart as well as on their schedule(s).
{code}
[powershell://name]
script = & stuff
schedule = 0 23 15 * * *
source = PowerShell
sourcetype = PowerShell:Name
index = my index
interval =
{code}
I want this ONLY to run at 15:23.
What I am seeing is that if the UF is restarted, it's run on startup, AND it's run on the schedule i tell it.
i don't want it running on UF startup.
I believe i'm using the quartz notation and that bit is working as intended, but I don't want this input to be run if the UF is restarted.
Why is this happening ?
Please share if the issue has been resolved in later releases.
Any update on this ... has it been resolved by Splunk ?
I believe this is a known issue. Please raise a case with Splunk Support quoting SPL-141385.
Any update? This issue still persists in 9.1.x version (and I assume in 9.2.x also because there is no information in release notes/fixed issues). Now it's very difficult to control the execution of scripts.
[script://] input has this feature implemented, but [powershell://] don't.
* NOTE: when you specify a cron schedule, the input does not run the script on start-up.
its the default behavior to run scripted inputs on forwarder start, i am not sure however how (and why) to disable it
That isn't very desirable. If i supply a schedule, then that's when i want it to run, not whenever the UF is restarted.