Getting Data In

Universal forwarded schedule

mghori
New Member

I have universal forwarded configured with a powershell script . I tried using a value of zero (0) for the schedule in the inputs.conf, but the script is never run. I then used a cron schedule to run the script every 5 minutes, which works but I can't tell is the forwarded waits for the previous script instance to finish and then start a new instance, or does it start a new instance regardless of whether the previous instance has finished or not. I've noticed memory issues with this approach, where after a day or two, the powershell process consumes all available memory.

How exactly do I make sure that my script is run as soon as the previous instance finishes?

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

In your script could you record the status of the script elsewhere? For example update/create a file when the script starts then update/delete the same file when the scripts finishes? The script should also check the same file to see the state of the file before the main processing happens. With this approach, you could set the script to run at smaller intervals without worrying about a previous run completing.

0 Karma

mghori
New Member

I can give that a try.
But I know if you have a scripted input, you can have an 'interval' attribute that does what I want i.e. when interval is set to 0, a new instance is started as soon as the old one finishes. But looks like for a powershell input, there is no 'interval' attribute, rather there is a 'schedule' attribute, which doesn't have a similar behavior as 'interval' for value 0 (as per the documentation )

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...