Universal forwarded schedule

[mghori]

I have universal forwarded configured with a powershell script . I tried using a value of zero (0) for the schedule in the inputs.conf, but the script is never run. I then used a cron schedule to run the script every 5 minutes, which works but I can't tell is the forwarded waits for the previous script instance to finish and then start a new instance, or does it start a new instance regardless of whether the previous instance has finished or not. I've noticed memory issues with this approach, where after a day or two, the powershell process consumes all available memory.

How exactly do I make sure that my script is run as soon as the previous instance finishes?

[msivill_splunk]

In your script could you record the status of the script elsewhere? For example update/create a file when the script starts then update/delete the same file when the scripts finishes? The script should also check the same file to see the state of the file before the main processing happens. With this approach, you could set the script to run at smaller intervals without worrying about a previous run completing.

[mghori]

I can give that a try.
But I know if you have a scripted input, you can have an 'interval' attribute that does what I want i.e. when interval is set to 0, a new instance is started as soon as the old one finishes. But looks like for a powershell input, there is no 'interval' attribute, rather there is a 'schedule' attribute, which doesn't have a similar behavior as 'interval' for value 0 (as per the documentation )