Getting Data In

Script input runs once, then never again

twinspop
Influencer

Inputs entry is:

[script://./bin/db_lockout_query.rb]
disabled = 0
sourcetype = dbjobs
source = db_lockout_query.rb
interval = 3600

When I restarted the Splunk forwarder, the input ran one time, and worked as expected. Splunkd.log shows:

09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor - New scheduled exec process: /opt/splunkforwarder/etc/apps/db_queries/bin/db_lockout_query.rb
09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor -     interval: 3600000 ms

and

09-18-2012 12:25:01.070 -0500 INFO  ExecProcessor - Ran script: /opt/splunkforwarder/etc/apps/db_queries
/bin/db_lockout_query.rb, took 15.16 seconds to run, 9722 bytes read

But never refers to the lockout query script again. I just changed the inputs stanza to use cron instead to see if that helps.

In the meantime, any ideas?

EDIT: Linux, 32-bit SUF, version 4.3.4

Tags (1)
1 Solution

twinspop
Influencer

I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."

View solution in original post

0 Karma

twinspop
Influencer

I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."

0 Karma

mixolydian
Path Finder

Are you sure that the script is exiting properly? If it is still running, Splunk won't run it again.

Update: Nevermind, from your output it appears that it is.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...