Splunk script execution inputs.conf Interval ?

[Harishma]

Hi All,

When the interval is provided as 1d i.e 86400s in the interval field in inputs.conf , when does the script get executed?

I understand every one hour it gets executed..But I wanted to understand at what time or when?

Is there a way to know this?

[harsmarvania57]

Hi @Harishma,

Your script will execute once in a day based on your interval given as 86400 seconds.

Answer for second question is, this script will start execute first time when you start/restart splunk forwarder and then it will execute next time after 86400 seconds. For example : You have started/restarted forwarder at 11:01 AM and first time script ran at 11:01 AM today then next time it will execute tomorrow at 11:01 AM.

I hope this helps.

Thanks,
Harshil

[p_gurav]

Hi Harishma,

interval = [|]
* How often to run the specified command (in seconds), or a valid cron
schedule.
* NOTE: when you specify a cron schedule, the input does not run the
script on start-up.
* If you specify the interval as a number, it may have a fractional
component; e.g., 3.14
* The cron implementation for data inputs does not currently support names
of months or days.
* Defaults to 60.0 seconds.
* The special value 0 forces this scripted input to be run continuously;
that is, as soon as the script exits, the input restarts it.
* The special value -1 causes the scripted input to run once on start-up.

Hope this will help.