Inputs entry is:
[script://./bin/db_lockout_query.rb]
disabled = 0
sourcetype = dbjobs
source = db_lockout_query.rb
interval = 3600
When I restarted the Splunk forwarder, the input ran one time, and worked as expected. Splunkd.log shows:
09-18-2012 12:24:43.411 -0500 INFO ExecProcessor - New scheduled exec process: /opt/splunkforwarder/etc/apps/db_queries/bin/db_lockout_query.rb
09-18-2012 12:24:43.411 -0500 INFO ExecProcessor - interval: 3600000 ms
and
09-18-2012 12:25:01.070 -0500 INFO ExecProcessor - Ran script: /opt/splunkforwarder/etc/apps/db_queries
/bin/db_lockout_query.rb, took 15.16 seconds to run, 9722 bytes read
But never refers to the lockout query script again. I just changed the inputs stanza to use cron instead to see if that helps.
In the meantime, any ideas?
EDIT: Linux, 32-bit SUF, version 4.3.4
I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."
I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."
Are you sure that the script is exiting properly? If it is still running, Splunk won't run it again.
Update: Nevermind, from your output it appears that it is.