Getting Data In

Universal forwarded schedule

mghori
New Member

I have universal forwarded configured with a powershell script . I tried using a value of zero (0) for the schedule in the inputs.conf, but the script is never run. I then used a cron schedule to run the script every 5 minutes, which works but I can't tell is the forwarded waits for the previous script instance to finish and then start a new instance, or does it start a new instance regardless of whether the previous instance has finished or not. I've noticed memory issues with this approach, where after a day or two, the powershell process consumes all available memory.

How exactly do I make sure that my script is run as soon as the previous instance finishes?

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

In your script could you record the status of the script elsewhere? For example update/create a file when the script starts then update/delete the same file when the scripts finishes? The script should also check the same file to see the state of the file before the main processing happens. With this approach, you could set the script to run at smaller intervals without worrying about a previous run completing.

0 Karma

mghori
New Member

I can give that a try.
But I know if you have a scripted input, you can have an 'interval' attribute that does what I want i.e. when interval is set to 0, a new instance is started as soon as the old one finishes. But looks like for a powershell input, there is no 'interval' attribute, rather there is a 'schedule' attribute, which doesn't have a similar behavior as 'interval' for value 0 (as per the documentation )

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...