Getting Data In

Script input runs once, then never again

twinspop
Influencer

Inputs entry is:

[script://./bin/db_lockout_query.rb]
disabled = 0
sourcetype = dbjobs
source = db_lockout_query.rb
interval = 3600

When I restarted the Splunk forwarder, the input ran one time, and worked as expected. Splunkd.log shows:

09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor - New scheduled exec process: /opt/splunkforwarder/etc/apps/db_queries/bin/db_lockout_query.rb
09-18-2012 12:24:43.411 -0500 INFO  ExecProcessor -     interval: 3600000 ms

and

09-18-2012 12:25:01.070 -0500 INFO  ExecProcessor - Ran script: /opt/splunkforwarder/etc/apps/db_queries
/bin/db_lockout_query.rb, took 15.16 seconds to run, 9722 bytes read

But never refers to the lockout query script again. I just changed the inputs stanza to use cron instead to see if that helps.

In the meantime, any ideas?

EDIT: Linux, 32-bit SUF, version 4.3.4

Tags (1)
1 Solution

twinspop
Influencer

I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."

View solution in original post

0 Karma

twinspop
Influencer

I tried many things, but in the end, changing the interval setting is all that was needed. I first tried 300, then 600, then 1200, and finally 1800. All worked without issue. Setting interval to 3600 causes the run-once-when-splunk-starts "feature."

0 Karma

mixolydian
Path Finder

Are you sure that the script is exiting properly? If it is still running, Splunk won't run it again.

Update: Nevermind, from your output it appears that it is.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...