Getting Data In

Splunk for Cisco IPS - connects to IPS every second regardless of "interval" setting



I've noticed after changing the interval setting within the inputs.conf for our various IPS' it still connects to the IPS' every 1 second regardless of what I set the interval to. Is there a reason for it not respecting this value? or is there a setting that I may be missing?

Thanks, Josh

0 Karma


Hi Josh,

I have the same troubles than you. After a quick look, I think I found the mistake :

File :

58 while 1:

59 try:

60 sdee.get()

61 except:


I do not know why, but the loop runs forever, there is no exit / break into this loop.
We should ask Splunk why....maybe it's a bug.

A quick and dirty fix, add a break at the end of the loop :

167 ### Commen/Uncomment to write to stdout

168 # print syslog_msg +"\n"

169 break

It seems to work for me. Do not forget to change the "interval" option to 60 for example.
Let me know if it works for you too.

0 Karma

Splunk Employee
Splunk Employee

Hey Josh, the SDEE connection module, used by, has a default 1 second retry on unsuccessful connections. As such, it sounds like it might be a connection issue.

The scripted input writes to log file $SPLUNK_HOME/var/log/splunk/sdee_get.log which contains status information for the connection. Have you tried checking that to see if there's any information there?

0 Karma


Yeah, I looked into the sdee_get.log initially and it does not report any issues, it shows successful connections to the IPS and then no more repeat messages. When I actually look at the process list on the machine (ps aux), I see the processes constantly running, should this be the case or should I only see them in the process list every X-minutes as they are configured within the inputs.conf

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...